> ## Documentation Index
> Fetch the complete documentation index at: https://docs.civicmarketplace.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate with the Partner API using Bearer tokens

All API requests (except `/health`) require a valid API key passed as a Bearer token in the `Authorization` header.

## API key format

```
cmp_live_aBcDeFgH.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

| Segment          | Description                                             |
| ---------------- | ------------------------------------------------------- |
| `cmp`            | Key prefix (always `cmp`)                               |
| `live` or `test` | Environment (`live` for production, `test` for sandbox) |
| `aBcDeFgH`       | 8-character lookup identifier                           |
| `.xxx...`        | 44-character secret                                     |

## Making authenticated requests

Pass your key in the `Authorization` header with the `Bearer` scheme:

```bash theme={null}
curl https://prod-api.civicmarketplace.com/v1/contracts \
  -H "Authorization: Bearer cmp_live_aBcDeFgH.your_secret_here"
```

## Environments

| Environment | Key prefix  | Base URL                                |
| ----------- | ----------- | --------------------------------------- |
| Production  | `cmp_live_` | `https://prod-api.civicmarketplace.com` |
| Sandbox     | `cmp_test_` | `https://uat-api.civicmarketplace.com`  |

Use `test` keys during development. They connect to sandbox data and won't affect production.

## Data scoping

Each API key is scoped to a partner account. You will only see contracts and suppliers that your partner account has been granted access to. If you need access to additional data, contact your account manager.

## Key rotation

When you rotate your API key, the previous key can optionally be revoked immediately. Plan for a brief overlap period if you need zero-downtime rotation:

1. Request a new key from your account manager
2. Update your application to use the new key
3. Confirm the old key is no longer in use
4. Request revocation of the old key

## Error responses

If your key is missing, invalid, or revoked:

```json theme={null}
{
	"error": {
		"code": "unauthorized",
		"message": "Missing or invalid API key",
		"request_id": "req_abc123"
	}
}
```

If your key is valid but you are accessing data outside your partner scope:

```json theme={null}
{
	"error": {
		"code": "forbidden",
		"message": "This resource is not accessible with your API key",
		"request_id": "req_def456"
	}
}
```