> ## Documentation Index
> Fetch the complete documentation index at: https://open-fi.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate requests to the OpenFi API.

OpenFi uses standard bearer API keys for account-level authentication, plus a separate signing scheme for agentic session keys.

## API keys

Every request must include your account API key in the `Authorization` header:

```bash theme={null}
curl https://api.openfi.co/v1/payments \
  -H "Authorization: Bearer sk_live_..."
```

| Prefix           | Environment                                      |
| ---------------- | ------------------------------------------------ |
| `sk_testnet_...` | Testnet: simulated rails, no real money movement |
| `sk_live_...`    | Mainnet                                          |

<Warning>
  Keep live API keys server-side only. Never embed a live key in client-side or agent-facing code; use a scoped session key instead (see below).
</Warning>

## Session keys (for autonomous agents)

An API key authenticates *your* backend. A **session key** authenticates an *individual AI agent* acting within the limits of a specific mandate. It's how an agent transacts without ever holding your master API key or a wallet's private key.

Session keys are:

* **Time-bound**: created with an explicit `expires_in`
* **Velocity-bound**: capped by the `max_amount` / `interval` set on the parent mandate
* **Revocable**: can be invalidated independently of the mandate that issued them

```bash theme={null}
curl https://api.openfi.co/v1/session-keys \
  -H "Authorization: Bearer $OPENFI_API_KEY" \
  -d '{ "mandate_id": "man_123", "expires_in": 86400 }'
```

See [Create a session key](/api-reference/agentic/create-session-key) for the full reference.

## Identity credentials

For flows that require proving an account or agent is a verified, unique, KYC'd entity, OpenFi issues **W3C Verifiable Credentials** (VC-JWT format), rooted at `did:web:openfi.co` for issuer identity and `did:pkh` for wallet-based subjects. See [Identity overview](/api-reference/identity/overview).