---
title: "Authentication"
description: "Core API keys, where to send them, and what happens when a key is revoked."
---

> Documentation Index
> Fetch the complete documentation index at: https://developer.unipage.be/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

Every Core API call carries the restaurant's Core API key.

## The key

A Core API key looks like this:

```
upg_capi_<business id>_<8 characters>.<secret part>
```

- The part before the dot identifies the key. The part after it is the
  secret; Unipage only stores a hash of it, so a lost key cannot be shown
  again. The restaurant creates a new one instead.
- The key belongs to one restaurant (one location). Use it only on that
  location's URL: `https://api.unipage.eu/{business id}/...`. On another
  location's URL it is refused with a 401.
- It has full access to that location. Keep it on your server, in a secret
  store or environment variable, never in a browser bundle, an app or a
  repository.

## Sending the key

Send it in the `X-API-Key` header:

### curl

```sh
curl https://api.unipage.eu/x94d3/customers \
  -H "X-API-Key: $UNIPAGE_CORE_API_KEY"
```

### Node.js

```js
const res = await fetch("https://api.unipage.eu/x94d3/customers", {
  headers: { "X-API-Key": process.env.UNIPAGE_CORE_API_KEY },
});
const { data } = await res.json();
```

### PHP

```php
$response = Http::withHeaders([
    'X-API-Key' => env('UNIPAGE_CORE_API_KEY'),
])->get('https://api.unipage.eu/x94d3/customers');
```

> **Caution**
>
> The query parameter `?api_key=` is also accepted, but it puts the key in
> every log line between you and Unipage (proxies, load balancers, your own
> access logs). Use the header.

## Revoking a key

The restaurant deletes the key on the same settings card. From that moment
every call with it is refused with a 401. A key can also be switched off
temporarily, which answers 403 until it is switched on again. See
[Errors and limits](/core/errors-and-limits/) for the exact responses.

Source: https://developer.unipage.be/core/authentication/index.mdx