> ## Documentation Index
> Fetch the complete documentation index at: https://mobiska-docs.stimuluzdev.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Secure your API requests with Mobiska Developer API

# API Authentication

Every request to Mobiska's API must be authenticated to ensure secure access to our services. We use Basic Authentication to verify the identity of API consumers.

## Authentication Flow

<Note>
  All API requests must include an Authorization header containing your encoded credentials. Requests without proper authentication will be rejected with a 401 Unauthorized response.
</Note>

### Constructing Your Credentials

Follow these steps to generate your Authorization header:

1. **Combine Keys**:
   ```bash theme={null}
   {client_key}:{secret_key}
   ```
   Example: `mob_client_123:sk_live_abcdef123456`

2. **Base64 Encode**:
   Convert the combined string to base64 format
   ```bash theme={null}
   # Example using command line
   echo -n "mob_client_123:sk_live_abcdef123456" | base64
   ```

3. **Create Header**:
   Prefix the encoded string with `Basic`
   ```bash theme={null}
   Authorization: Basic {base64_encoded_string}
   ```

## Obtaining API Keys

<Steps>
  <Step title="Create Developer Account">
    Register at [dashboard.mobiska.com](https://dashboard.mobiska.com) to access the developer portal
  </Step>

  <Step title="Complete Verification">
    Submit required business documentation and complete the verification process
  </Step>

  <Step title="Find API Keys">
    Once verified, find your Client Key and Secret Key from the dashboard
  </Step>
</Steps>

## Request Example

Here's how to include authentication in your API requests:

```bash theme={null}
curl -X POST https://mobiska-api.stimuluzdev.com/make_payment \
  -H "Authorization: Basic bW9iX2NsaWVudF8xMjM6c2tfbGl2ZV9hYmNkZWYxMjM0NTY=" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 1000,
    "currency": "USD",
    "description": "Test payment"
  }'
```

## Security Guidelines

Protect your API credentials with these best practices:

<CardGroup cols={2}>
  <Card title="Secure Storage" icon="lock">
    Never expose API keys in client-side code or public repositories
  </Card>

  <Card title="Environment Separation" icon="layer-group">
    Use different API keys for development and production environments
  </Card>

  <Card title="Regular Rotation" icon="rotate">
    Periodically rotate your API keys to minimize security risks
  </Card>

  <Card title="Access Control" icon="user-lock">
    Implement IP whitelisting for additional security
  </Card>
</CardGroup>

## Handling Authentication Errors

Common authentication-related errors you might encounter:

| Status Code | Description              | Resolution                               |
| ----------- | ------------------------ | ---------------------------------------- |
| 401         | Invalid credentials      | Check if your API keys are correct       |
| 403         | Insufficient permissions | Verify your account has necessary access |
| 429         | Rate limit exceeded      | Implement proper request throttling      |

<Warning>
  If you suspect your API credentials have been compromised, immediately rotate your keys from the dashboard and contact our support team.
</Warning>

For additional security measures and best practices, refer to our [Security Guide](/security).