> ## Documentation Index
> Fetch the complete documentation index at: https://developer.9squid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Learn how to obtain your API key and authenticate every request to the 9Squid API.

## Overview

The 9Squid API uses **Bearer token authentication**. Every request must include a valid API key in the `Authorization` header. Requests made without a token — or with an invalid one — will be rejected with a `401 Unauthorized` response.

***

## Step 1 — Request an API Key

API keys are provisioned manually. To get one, send an email to:

**[support@9squid.com](mailto:support@9squid.com)**

Include the following in your request:

| Field            | Description                                |
| ---------------- | ------------------------------------------ |
| **Name**         | Your full name                             |
| **Organization** | Company or team name                       |
| **Role**         | `Originator`, `Investor`, or `Both`        |
| **Environment**  | `Development`, `Staging`, or `Production`  |
| **Use case**     | Brief description of what you are building |

The team will provision your key and reply with your credentials. Keys are environment-specific — a development key will not work against the production base URL.

***

## Step 2 — Pass the Key as a Bearer Token

Once you have your API key, include it in the `Authorization` header of every request:

```http theme={null}
Authorization: Bearer <your_api_key>
```

### Example — cURL

```bash theme={null}
curl -X GET "https://api.9squid.com/v1/api/deals" \
  -H "Authorization: Bearer <your_api_key>" \
  -H "Content-Type: application/json"
```

### Example — JavaScript (fetch)

```javascript theme={null}
const response = await fetch('https://api.9squid.com/v1/api/deals', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer <your_api_key>',
    'Content-Type': 'application/json'
  }
});
```

### Example — Python (requests)

```python theme={null}
import requests

headers = {
    'Authorization': 'Bearer <your_api_key>',
    'Content-Type': 'application/json'
}

response = requests.get('https://api.9squid.com/v1/api/deals', headers=headers)
```

***

## Token Scopes

Your API key is tied to a specific role. Calling an endpoint outside your role returns `403 Forbidden`.

| Role           | Access                                                                     |
| -------------- | -------------------------------------------------------------------------- |
| **Originator** | Loan management, pools, selection criteria, deal room documents, analytics |
| **Investor**   | Deal marketplace, portfolio, subscriptions, allocations, reports           |
| **Both**       | Alerts, webhooks                                                           |

If you receive a `403` on an endpoint you expect to access, verify your role with [support@9squid.com](mailto:support@9squid.com).

***

## Authentication Errors

| Status Code        | Cause                                         | Fix                                                                        |
| ------------------ | --------------------------------------------- | -------------------------------------------------------------------------- |
| `401 Unauthorized` | Missing or malformed `Authorization` header   | Ensure the header is present and formatted as `Bearer <token>`             |
| `401 Unauthorized` | Invalid or expired API key                    | Contact [support@9squid.com](mailto:support@9squid.com) to rotate your key |
| `403 Forbidden`    | Valid token but insufficient role permissions | Confirm your role covers the endpoint you are calling                      |

***

## Security Best Practices

* **Never expose your API key in client-side code** (browser JavaScript, mobile apps). Always proxy requests through your backend.
* Store keys in environment variables or a secrets manager — not in source code or version control.
* If you suspect your key has been compromised, contact [support@9squid.com](mailto:support@9squid.com) immediately to have it rotated.

***

## Support

For API key requests, rotations, or access issues contact **[support@9squid.com](mailto:support@9squid.com)**.

Check **[status.9squid.com](https://status.9squid.com)** for current platform status and incident history before opening a ticket.