# Authenticate API requests

> The GenHealth API accepts GenHealth API keys and supported JWTs through the HTTP bearer authorization scheme.

Source: [https://genhealth.ai/docs/authentication](https://genhealth.ai/docs/authentication)

## Choose a credential

Use the credential type provisioned for your integration. API keys are intended for server-to-server requests. Supported JWTs are validated for issuer, audience, expiration, and GenHealth access before a request is authorized.

| Credential | Best for | Storage |
| --- | --- | --- |
| GenHealth API key | Server-to-server integrations | Encrypted server-side secret storage |
| Supported JWT | Short-lived delegated access | Your existing secure token lifecycle |

## Bearer tokens

Include the credential in the Authorization header of every request. GenHealth resolves the organization and permitted operations from the token.

```http
Authorization: Bearer <YOUR_API_KEY>
```

## Permissions and organization access

The read endpoints in this preview require API read access. Every request is scoped to the organization resolved from the credential, so a valid resource ID from another organization is not sufficient to grant access.

## Token security

- Keep credentials on the server and outside browser bundles.
- Store secrets in an encrypted environment or secret manager, not in source control.
- Rotate a credential immediately if it may have been exposed.
- Use separate credentials for development and production environments.

> **Protect healthcare data**
>
> Do not paste production API keys, patient information, or live request bodies into documentation search or Maya chat.

## Troubleshoot authentication errors

| Symptom | Likely cause | Next check |
| --- | --- | --- |
| 401 Unauthorized | Missing, expired, or invalid credential | Authorization header format and credential status |
| 403 Forbidden | Credential lacks access to the operation | Assigned API permissions and organization |
| 404 Not Found | Resource is unavailable in the resolved organization | Resource ID and environment |