> ## Documentation Index
> Fetch the complete documentation index at: https://api-docs.kychospitality.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

Authentication is done system-to-system via an API key, which is scoped to a specific property at a brand, so you must be sure you are sending the right key to act on data for an individual property.  There are currently no brand-level authentication methods.

API keys are opaque ASCII strings that you must send as a standard bearer header, as in:

`Authorization: Bearer <key>`

This API key represents YOUR system’s access to KYC data and you must protect it at all times.  Never record or send it in email, Slack, or anywhere else.

## Getting an API Key

API keys are issued by the KYC support team and will be sent to you via secure one-time-use channels.

## Key Rotation

KYC supports key rotation on a manual or as-needed basis.  For rotation, a new key will be issued and the old key will continue to work for an agreed-upon time and then disabled.

## Authorization

Each API Key is scoped to a single property and specific endoints and actions.
There permissions will be setup when your API Key is created, so if you have permission issues, please
write to [Support@KYCHospitality.com](mailto:Support@KYCHospitality.com)

## Authentication Failures

Authentication can fail in various ways:

### API Key Authentication Failure

#### Failures include:

* API\_KEY\_NOT\_FOUND - API Key Not Found - The API key did not match a valid key. This may be because the key does not exist, the key was changed, or the key is wrong.
* INVALID\_API\_KEY - Invalid API Key - The API key format is not correct, such as wrong length or contains invalid characters.
* MISSING\_AUTH\_HEADER - Missing Authorization Header - The Authorization header was not found.
* INVALID\_AUTH\_HEADER - Invalid Authorization Header - The Authorization header was not valid, usually due to missing "Bearer " at the start of the header.