> For the complete documentation index, see [llms.txt](https://docs.tebex.io/developers/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tebex.io/developers/headless-api/authorization.md).

# Authorization

Most Headless API endpoints **do not require authorization**. 

Auth may be required in cases where user data is returned, such as retrieving purchased Tiers.

When required, you'll need to use HTTP BASIC auth with the following details:

<table data-header-hidden><thead><tr><th width="243"></th><th></th></tr></thead><tbody><tr><td>Username <strong>(Public Token)</strong></td><td>Your Public Token (you can get this from <a href="https://creator.tebex.io/developers/api-keys">https://creator.tebex.io/developers/api-keys</a>)</td></tr><tr><td>Password <strong>(Private Key)</strong></td><td>Your Private Key (you can get this from <a href="https://creator.tebex.io/developers/api-keys">https://creator.tebex.io/developers/api-keys</a>)</td></tr></tbody></table>

{% hint style="info" %}
Your Public Token starts with 4 characters and a dash (ex. `spk3-d515a30...`)
{% endhint %}

{% hint style="danger" %}
The private key enables full access to your account. Follow best security practices to keep your keys safe. Don't embed any secret keys in your source code or client-side applications.&#x20;

If your key is ever compromised, it can be rotated in your Tebex panel [here](https://creator.tebex.io/developers/api-keys).
{% endhint %}