> ## Documentation Index
> Fetch the complete documentation index at: https://developers.everhour.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate requests to the Everhour API using an API key.

All API requests must be authenticated. Everhour uses API key authentication — pass your key in the `X-Api-Key` request header.

## Getting your API key

1. Sign in to your Everhour account.
2. Go to your [profile page](https://app.everhour.com/#/account/profile).
3. Scroll to the bottom — your API key is shown there.

## Using the API key

Include the key in every request:

```http theme={null}
X-Api-Key: YOUR_API_KEY
```

<Note>
  You can also pass the key as an `api_key` query parameter (for example, `?api_key=YOUR_API_KEY`). The `X-Api-Key` header is recommended — query strings can be recorded in server logs and browser history.
</Note>

**Example:**

<CodeGroup>
  ```bash Bash/cURL theme={null}
  curl https://api.everhour.com/users/me \
    -H "X-Api-Key: YOUR_API_KEY"
  ```

  ```ruby Ruby theme={null}
  require "net/http"

  uri = URI("https://api.everhour.com/users/me")
  req = Net::HTTP::Get.new(uri)
  req["X-Api-Key"] = "YOUR_API_KEY"
  resp = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
  puts resp.body
  ```

  ```python Python theme={null}
  import requests

  response = requests.get(
      "https://api.everhour.com/users/me",
      headers={"X-Api-Key": "YOUR_API_KEY"}
  )
  print(response.json())
  ```

  ```php PHP theme={null}
  $ch = curl_init("https://api.everhour.com/users/me");
  curl_setopt($ch, CURLOPT_HTTPHEADER, ["X-Api-Key: YOUR_API_KEY"]);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  echo curl_exec($ch);
  curl_close($ch);
  ```

  ```java Java theme={null}
  import java.net.URI;
  import java.net.http.*;

  HttpClient client = HttpClient.newHttpClient();
  HttpRequest request = HttpRequest.newBuilder()
      .uri(URI.create("https://api.everhour.com/users/me"))
      .header("X-Api-Key", "YOUR_API_KEY")
      .GET()
      .build();
  HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
  System.out.println(response.body());
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch("https://api.everhour.com/users/me", {
    headers: { "X-Api-Key": "YOUR_API_KEY" }
  });
  console.log(await response.json());
  ```

  ```go Go theme={null}
  // import "fmt"; "io"; "net/http"
  req, _ := http.NewRequest("GET", "https://api.everhour.com/users/me", nil)
  req.Header.Set("X-Api-Key", "YOUR_API_KEY")
  resp, _ := http.DefaultClient.Do(req)
  defer resp.Body.Close()
  body, _ := io.ReadAll(resp.Body)
  fmt.Println(string(body))
  ```

  ```csharp .NET theme={null}
  using var client = new HttpClient();
  client.DefaultRequestHeaders.Add("X-Api-Key", "YOUR_API_KEY");
  var body = await client.GetStringAsync("https://api.everhour.com/users/me");
  Console.WriteLine(body);
  ```
</CodeGroup>

## What happens without a valid key

If the `X-Api-Key` header is missing or the key is invalid, the API returns:

```http theme={null}
HTTP/1.1 403 Forbidden
```

```json theme={null}
{
  "code": 403,
  "message": "Access denied"
}
```

## Security recommendations

* Store the API key in environment variables, not in source code.
* Rotate the key if you suspect it has been compromised — you can regenerate it from your profile page.
* Each API key is tied to a specific user account and inherits that user's permissions.

<Note>
  At this time, Everhour supports one API key per user account. OAuth or fine-grained scopes are not currently available.
</Note>