# Authentication

> API keys, signing secrets, OAuth, and Merchant Callback HMAC verification.

Source: https://help.boltapp.com/api-reference/authentication

Authenticate every outbound request to Bolt with your division's credentials from the [Merchant Dashboard](https://merchant.boltapp.com).

## Key types [#key-types]

| Key                 | Where to use             | How                                                                            |
| ------------------- | ------------------------ | ------------------------------------------------------------------------------ |
| **API key**         | Your backend server      | `X-API-Key` header on outbound REST calls                                      |
| **Signing secret**  | Your backend server      | Verify `X-Bolt-Hmac-Sha256` on inbound webhooks and Merchant Callback requests |
| **Publishable key** | Storefront / client SDKs | Initialize Bolt Connect, checkout modal, or embeddable components              |

Each division has its own keys. Sandbox and production credentials are separate: see [Environments](/api-reference/environments).

## Outbound API calls [#outbound-api-calls]

Server-side requests require your **API key** in the `X-API-Key` header and `Content-Type: application/json` for JSON bodies.

Some endpoints also accept `X-Nonce`: a unique value per request (a UUID works well). Check the endpoint reference if your call fails validation.

<CodeGroup>
  <CodeBlockTabs defaultValue="TypeScript">
    <CodeBlockTabsList>
      <CodeBlockTabsTrigger value="TypeScript">
        TypeScript
      </CodeBlockTabsTrigger>

      <CodeBlockTabsTrigger value="JavaScript">
        JavaScript
      </CodeBlockTabsTrigger>

      <CodeBlockTabsTrigger value="Python">
        Python
      </CodeBlockTabsTrigger>

      <CodeBlockTabsTrigger value="cURL">
        cURL
      </CodeBlockTabsTrigger>
    </CodeBlockTabsList>

    <CodeBlockTab value="TypeScript">
      ```typescript
      const baseUrl: string =
        process.env.BOLT_API_BASE_URL ?? "https://api-sandbox.boltapp.com";

      const apiKey = process.env.BOLT_API_KEY;
      if (!apiKey) throw new Error("Missing BOLT_API_KEY");

      const response = await fetch(`${baseUrl}/v1/merchant/orders`, {
        method: "POST",
        headers: {
          "Content-Type": "application/json",
          "X-API-Key": apiKey,
        },
        body: JSON.stringify({ cart }),
      });
      ```
    </CodeBlockTab>

    <CodeBlockTab value="JavaScript">
      ```javascript
      const baseUrl = process.env.BOLT_API_BASE_URL ?? "https://api-sandbox.boltapp.com";

      const response = await fetch(`${baseUrl}/v1/merchant/orders`, {
        method: "POST",
        headers: {
          "Content-Type": "application/json",
          "X-API-Key": process.env.BOLT_API_KEY,
        },
        body: JSON.stringify({ cart }),
      });
      ```
    </CodeBlockTab>

    <CodeBlockTab value="Python">
      ```python
      import os
      import requests

      base_url = os.environ.get("BOLT_API_BASE_URL", "https://api-sandbox.boltapp.com")

      requests.post(
          f"{base_url}/v1/merchant/orders",
          headers={
              "Content-Type": "application/json",
              "X-API-Key": os.environ["BOLT_API_KEY"],
          },
          json={"cart": cart},
      )
      ```
    </CodeBlockTab>

    <CodeBlockTab value="cURL">
      ```bash
      curl -X POST 'https://api-sandbox.boltapp.com/v1/merchant/orders' \
        -H 'Content-Type: application/json' \
        -H 'X-API-Key: YOUR_API_KEY' \
        -d '{"cart": {...}}'
      ```
    </CodeBlockTab>
  </CodeBlockTabs>
</CodeGroup>

Use your **publishable key** only in client-side SDK initialization: never in server-side API calls.

## Merchant Callback (inbound) [#merchant-callback-inbound]

When Bolt calls your server, verify the `X-Bolt-Hmac-Sha256` header using your **signing secret**. See [Verify webhooks](/api-reference/guides/verify-webhooks).

## OAuth (shopper accounts) [#oauth-shopper-accounts]

Third-party apps use the OAuth 2.0 authorization code flow to access Bolt Account data. See [Bolt OAuth](https://help.boltapp.com/developers/bolt-oauth/).

## Key rotation [#key-rotation]

Bolt supports rotating API keys and signing secrets without downtime. See [API keys](/getting-started/api-keys) for dashboard steps.

## Related [#related]

* [API Quickstart](/api-reference/api-quickstart)
* [Environments](/api-reference/environments)
* [API keys guide](/getting-started/api-keys)