> For the complete documentation index, see [llms.txt](https://globalmoo.gitbook.io/globalmoo-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://globalmoo.gitbook.io/globalmoo-documentation/core/authentication.md).

# Authentication

The globalMOO API uses API keys for authentication. To access the API, you'll need to include your API key in the authorization header of each request.

## API Keys

API keys should be included in the `Authorization` header of each request:

```
Authorization: Bearer your-api-key-here
```

## SDK Authentication

{% tabs %}
{% tab title="Python" %}

```python
from globalmoo.client import Client
from globalmoo.credentials import Credentials

# Method 1: Using environment variables
client = Client()

# Method 2: Direct credentials
credentials = Credentials(
    api_key="your-api-key",
    base_uri="https://app.globalmoo.com/api/",
    validate_tls=True  # Defaults to True, required for globalmoo.ai domains
)
client = Client(credentials=credentials)
```

{% endtab %}

{% tab title="Node.js" %}

```javascript
const { Client } = require('globalmoo');

// Method 1: Using environment variables
const client = new Client();

// Method 2: Direct configuration
const client = new Client({
    apiKey: "your-api-key",
    baseUri: "https://app.globalmoo.com/api/",
    validateTls: true  // Defaults to true, required for globalmoo.ai domains
});
```

{% endtab %}

{% tab title="PHP" %}

```php
use GlobalMoo\Client;
use GlobalMoo\Credentials;

// Method 1: Using environment variables
$client = new Client();

// Method 2: Direct credentials
$credentials = new Credentials(
    apiKey: "your-api-key",
    baseUri: "https://app.globalmoo.com/api/",
    validateTls: true  // Defaults to true, required for globalmoo.ai domains
);
$client = new Client($credentials);
```

{% endtab %}
{% endtabs %}

## Environment Variables

The SDKs support loading credentials from environment variables:

* `GMOO_API_KEY`: Your API key
* `GMOO_API_URI`: API base URI (defaults to <https://app.globalmoo.com/api/>)

## TLS Validation

The SDKs validate TLS certificates by default for security. This is required when using official globalmoo.ai domains but can be disabled for testing:

{% tabs %}
{% tab title="Python" %}

```python
# For local testing with self-signed certificates
credentials = Credentials(
    api_key="your-api-key",
    base_uri="https://localhost:8443/",
    validate_tls=False
)
```

{% endtab %}

{% tab title="Node.js" %}

```javascript
// For local testing with self-signed certificates
const client = new Client({
    apiKey: "your-api-key",
    baseUri: "https://localhost:8443/",
    validateTls: false
});
```

{% endtab %}

{% tab title="PHP" %}

```php
// For local testing with self-signed certificates
$credentials = new Credentials(
    apiKey: "your-api-key",
    baseUri: "https://localhost:8443/",
    validateTls: false
);
```

{% endtab %}
{% endtabs %}

## Security Best Practices

1. Keep your API key secure and never share it
2. Use environment variables to store API keys
3. Rotate API keys periodically
4. Use different API keys for development and production