---
title: Authentication
description: Authenticate safely with the VaniAgent Developer API.
---

Developer API requests use an API key in the `X-API-Key` header.

```bash
curl https://api.vaniagent.com/api/developer/v1/agents \
  -H "X-API-Key: $VANIAGENT_API_KEY"
```

Create and revoke keys in the VaniAgent dashboard. Store keys in a server-side secret manager or environment variable; never expose them in browser JavaScript, mobile bundles, screenshots, or Git.

## Errors

| Response | Meaning |
| --- | --- |
| `401` | Key is missing, invalid, or revoked |
| `403` | The key/account cannot perform the operation |
| `404` | The resource is unavailable to the authenticated account |
| `422` | Request fields failed validation |
| `429` | Too many requests; retry with backoff |

Use exponential backoff with jitter for `429` and transient `5xx` responses. Do not retry validation or authentication failures unchanged.