# Authentication (/guides/authentication)



## API Authentication [#api-authentication]

Every requests to Acme API must include a secret API key in the HTTP request header. For example,

```sh
curl --header "Authorization: Bearer YOUR_API_KEY_HERE" https://api.tryacme.com/v1/transactions
```

Acme Mode, whether `LIVE` or `TEST`, will be determined based on the API key set in the request header.

## Retrieve API Keys [#retrieve-api-keys]

Please contact Acme to retrieve your API keys.

<Callout type="warn" title="Keeping your keys safe">
  Treat your secret API key as you would any other password. Secret API keys should not be in your
  client-side code and should not be checked into your source version control system.
</Callout>