> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sprig.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and authorization

> Authenticate Study API requests with an environment API key.

All Study API requests use HTTPS and send credentials in the `Authorization` header. Never expose
credentials in browser code, mobile applications, logs, source control, or support messages.

## Environment API key

Use an environment API key for server-to-server integrations:

```http theme={null}
Authorization: API-Key YOUR_API_KEY
```

Each key belongs to one Production or Development environment. The key selects the environment for
the request, so an environment header is not needed.

```bash theme={null}
curl https://api.sprig.com/v2/studies \
  --header "Authorization: API-Key $SPRIG_API_KEY"
```

Use a Development key to test an integration without changing Production Studies. Team members with
the Admin or Developer role can find environment API keys in **Integrations > Enrichment > Data
Import API**.

## Authentication failures

| Status | Meaning | Action |
| - | - | - |
| `403` | The API key is missing or invalid, cannot access the resource, or the Study API is unavailable for the account. | Check the key, selected environment, and account access. |

Do not retry `403` in a tight loop. Resolve the credential or account-access problem first.

## Credential handling

* Store API keys in a secret manager.
* Use separate credentials for Production and Development.
* Rotate a credential immediately if it may have been exposed.
* Redact `Authorization` values from logs and traces.