> ## Documentation Index
> Fetch the complete documentation index at: https://docs.winampay.de/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate requests to the Winam Payments API.

## API Key

All API requests must include the header:

```http theme={null}
X-API-Key: <your_api_key>
```

Your API key is provided by Winam. Contact [support@eins-innovativ.de](mailto:support@eins-innovativ.de) to obtain one.

<Warning>
  Never expose your API key in client-side code. Always call the API from your backend.
</Warning>

## Unauthenticated endpoints

The only endpoint that does **not** require authentication is:

* `GET /health` — infrastructure health check (used by load balancers)

## 401 error response

```json theme={null}
{
  "detail": "Invalid or missing API key."
}
```

<Note>
  In development mode (when `SPORTSBOOK_API_KEY` is empty), authentication is disabled — all requests are accepted. This is the default when running with docker-compose locally.
</Note>

## Webhook verification

Outbound webhooks (sent from winam-payments to your `callback_url`) are signed with a JWT RS256 token in the `X-Winam-Signature` header. See [Webhooks](/api-reference/webhooks) for verification details.