> ## Documentation Index
> Fetch the complete documentation index at: https://docs.repdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication & Access

> Request a Supply API key and authenticate every request with the obfuscated GUID.

<Note>
  To use the Supply API you will need a Supply API key, provisioned by Rep Data's Supply team.
</Note>

## Requesting Credentials

To obtain authentication credentials, first contact Rep Data's Supply team at [supply@repdata.com](mailto:supply@repdata.com) and request credentials. Suppliers that have not worked with Rep Data previously will also need to complete the new supplier onboarding process with Rep Data's Finance team.

## API Key Authentication

Authentication is done via an obfuscated GUID (your API key) associated with each supplier. The key is passed in the `Authorization` header of every request.

| Key             | Value                      | Required | Description                          |
| --------------- | -------------------------- | -------- | ------------------------------------ |
| `Authorization` | Your Supply API key (GUID) | Yes      | Unique identifier for your platform. |

Example header:

```text theme={null}
Authorization: 5bf1ae0d-148b-4160-ad0c-fa3ad96b90c5
```

The Supply API will only return a valid response when called with the appropriate obfuscated API key. We recommend making API calls server-to-server, which fully protects the payload — no third party will be able to access it.

<Warning>
  **Keep your key secure.** Do not share your API key with any third party. Keep your key and all log-in information secure, and use the API key as your sole means of accessing the API. Rep Data reserves the right to revoke your API key at any time.
</Warning>

Your API key also serves as your **secret key** for validating secure redirects (link hashing). See [Secure Redirects: Link Hashing](https://docs.repdata.com/supply/guides/04-secure-redirects).

## Roadmap

In a future release, Rep Data plans to offer an encrypted, tokenized authentication method for additional security. The API key method described here will continue to be supported.