# Authentication and API keys

Understand X-API-Key, RapidAPI authentication, portal sessions and safe credential handling for IaBula integrations.

Canonical: https://iabula.com/docs/en/authentication

## Direct access: X-API-Key

Send your key in the X-API-Key header on each /v1 request. Your account portal supports key creation and revocation subject to its identity verification controls. The secret is shown once at creation; later listings contain identifiers and status.

```bash
curl --fail-with-body --get "$IABULA_API_BASE/v1/medications/search" \
  --header "X-API-Key: $IABULA_API_KEY" \
  --data-urlencode 'q=dipirona' \
  --data-urlencode 'limit=20'
```

- [Manage keys](https://iabula.com/account#account-api-keys)

## Marketplace access

RapidAPI Hub calls use the credentials and headers provided by the marketplace. Do not use your direct IaBula key as a RapidAPI key or send internal gateway secrets. Use the listing's generated integration snippet for your subscription.

- [RapidAPI guide](https://iabula.com/docs/en/rapidapi)

## Web sessions and API requests

Login maintains your portal session. The REST API uses separate authentication; a session cookie does not replace an API key. Check your account plan, limits and usage when sizing an integration. Limits depend on plan and channel; there is no universal quota in this guide.

## Protect your credentials

- Use HTTPS and keep the key on your server.
- Do not include keys in URLs, logs, screenshots, commits or public JavaScript.
- If a key is exposed, revoke it and update your integration.
- Never share infrastructure secrets or try to authenticate through internal gateway headers.

- [401, 403 and 429 responses](https://iabula.com/docs/en/errors)

## Resources

- [OpenAPI JSON](https://iabula.com/openapi.json)
- [Swagger](https://iabula.com/docs/swagger)
- [Documentation index](https://iabula.com/llms.txt)