# Authentication

> Every request carries your API key in the x-api-key header.

## Get your API key

Generate your API key in [Orbita](https://admin.melonn.com), under **Integrations** → [**API**](https://admin.melonn.com/api-token).

<Warning>
  Treat your API key like a password. Anyone who has it can act on your account. Do not commit it to a repository or expose it in a browser or mobile app.
</Warning>

## Send it with every request

Send the key in the `x-api-key` header:

```bash
curl https://api.orbita.melonn.com/sell-orders \
  -H "x-api-key: YOUR_API_KEY"
```

| Status | When |
| --- | --- |
| `401 Unauthorized` | The `x-api-key` header is missing. |
| `403 Forbidden` | The key is invalid or inactive, or it is not allowed to use that endpoint. |

## Rate limiting

Melonn may answer `429 Too Many Requests` when a client sends excessive traffic. If you receive it, wait before retrying, and spread your requests over time instead of sending them in bursts.