> ## Documentation Index
> Fetch the complete documentation index at: https://devdraft.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# API Request Authentication

> How to authenticate your API requests to Devdraft.

All requests to the Devdraft API must include your client key and client secret in the request headers. Both are required on every call.

```bash theme={null}
x-client-key: <YOUR_CLIENT_KEY>
x-client-secret: <YOUR_CLIENT_SECRET>
```

You can generate and manage your API keys from **Settings → App Settings** in the [Devdraft Console](https://console.devdraft.ai).

| Header            | Required | Description                                               |
| ----------------- | -------- | --------------------------------------------------------- |
| `x-client-key`    | Yes      | Your public client key. Identifies your account           |
| `x-client-secret` | Yes      | Your secret key. Authenticates the request                |
| `Idempotency-Key` | No       | A unique key to safely retry requests without duplication |

| Error                  | Status | Meaning                                        |
| ---------------------- | ------ | ---------------------------------------------- |
| `authentication_error` | 401    | Missing or invalid credentials                 |
| `permission_error`     | 403    | Valid credentials but insufficient permissions |

<Warning>
  Never expose your client secret in frontend code, mobile apps, or public repositories. Store it as a server-side environment variable only.
</Warning>