# Authentication

The Blueink API uses API keys to authenticate requests. 
You can view and manage your API keys in the Blueink Dashboard, in the API->Apps section.

**Be sure to keep your API key secret!** An API key identifies your App and allows it to make calls to the
Blueink API on your behalf, including sending documents for eSignature. It should never be exposed publicly
in client-side code (e.g. javascript source files that are downloaded to a browser) or committed into
source control (e.g. a github repo).

> **Notice**
>
>
> If an API key is ever compromised or exposed publicly, you should immediately disable or delete the compromised
> API key in the Blueink Dashboard and generate a new one.
>

## Authentication in API Requests

All requests to the Blueink API must include an `Authorization` header with the value `Token <your-api-key>`.

For example (using `curl`):

```bash
curl -X GET https://api.blueink.com/api/v2/bundles/ \
  -H "Authorization: Token YOUR_API_KEY"
```

**Quick Links:**

- [Postman Collection](https://postman.com/blueink) - A collection of Blueink API requests that 
you can use to test and explore the API. The Blueink Postman collection shows the proper way to
authenticate requests, and includes an environment variable where you can set your API key.
- [OpenAPI](/docs/api/)