> ## Documentation Index
> Fetch the complete documentation index at: https://dev.ownright.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Learn how to authenticate with the Ownright Developer Platform

To use any Ownright API, you must authenticate each request with a set of headers that
identify your application and prove that the request is authorized. The authentication process
is simple and stateless — just supply three headers with each request.

## Overview

Every API request must include the following headers:

<ul>
  <li>`X-Ownright-Client-Id` - Identifies your registered API client</li>
  <li>`X-Ownright-API-Key` - Authenticates your request</li>

  <li>
    `X-Ownright-Organization-Id` - Specifies the Ownright platform organization
  </li>
</ul>

<Note>
  All three headers are required for every request, regardless of which API you
  are using.
</Note>

## Steps to obtain and use an API key

<Steps>
  <Step title="Register an API client">
    Contact the Ownright team ([developers@ownright.com](mailto:developers@ownright.com)) to register your application. Once registered, you'll
    receive a unique client ID. You must include this in the `X-Ownright-Client-Id` header
    in every request.

    <Info>Self-service client registration will be available soon.</Info>
  </Step>

  <Step title="Request an API key">
    Our team will issue one or more long-lived API keys tied to your API client record.
    These act like permanent access tokens. You must include the API key in the `X-Ownright-API-Key`
    header with every request.

    <Info>Treat your API keys like secrets — keep them out of client-side code and version control.</Info>
  </Step>

  <Step title="Add the organization ID">
    All requests must include a shared `X-Ownright-Organization-Id` header. This value is
    constant and identifies the core Ownright platform internally.

    We'll provide the correct value during onboarding. There is no need to manage or
    change this identifier.
  </Step>
</Steps>

### Sample request

Refer to the **Connecting** page in your API's reference section for the specific endpoint URL. Here's the general shape of a request:

```http theme={null}
POST /<api-path>/graphql HTTP/1.1
Host: api.ownright.com
X-Ownright-Client-Id: your-client-id
X-Ownright-API-Key: your-api-key
X-Ownright-Organization-Id: ownright-prod-org
Content-Type: application/json

{
  "query": "query { ... }"
}
```

## Security and key management

<ul>
  <li>API keys are tied to your business account and logged internally</li>
  <li>Store them securely — rotate if compromised</li>
  <li>Contact [developers@ownright.com](mailto:developers@ownright.com) to revoke or generate new keys</li>

  <li>
    Webhook signature verification is covered separately in the [Webhooks
    section](/fundamentals/webhooks)
  </li>
</ul>