> ## Documentation Index
> Fetch the complete documentation index at: https://developer.quickei.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Obtain and use your API credentials

Quickei uses two authentication methods depending on the API you're using.

## Payment Gateway API — Bearer Token

The Payment Gateway API uses OAuth-style bearer tokens. First, exchange your credentials for a token, then include it in subsequent requests.

<Steps>
  <Step title="Get your credentials">
    Log in to your [Merchant Dashboard](https://quickei.io/merchant/login) and navigate to **Developer API > API Keys**. Copy your **Client/Primary Key** and **Secret Key**.
  </Step>

  <Step title="Request a token">
    Call the [Access Token](/api-reference/01-access-token) endpoint with your credentials.

    ```bash theme={null}
    curl -X POST https://quickei.io/pay/sandbox/api/v1/authentication/token \
      -H "Content-Type: application/json" \
      -d '{
        "client_id": "YOUR_CLIENT_ID",
        "secret_id": "YOUR_SECRET_ID"
      }'
    ```
  </Step>

  <Step title="Use the token">
    Include the token in the `Authorization` header for all subsequent requests.

    ```bash theme={null}
    Authorization: Bearer nyXPO8Re5SXP...
    ```
  </Step>
</Steps>

<Warning>
  Tokens expire after **10 minutes** (600 seconds). Implement token refresh logic in your integration to request a new token before expiry.
</Warning>

## POS API — HTTP Basic Auth

The POS API uses HTTP Basic Authentication. Encode your `client_id:client_secret` as base64.

```bash theme={null}
# Format
Authorization: Basic base64(client_id:client_secret)

# Example
Authorization: Basic Y2xpZW50X2lkOmNsaWVudF9zZWNyZXQ=
```

## Security Best Practices

<CardGroup cols={2}>
  <Card title="Keep keys secret" icon="eye-slash">
    Never expose API keys in client-side code, mobile apps, or public repositories.
  </Card>

  <Card title="Use environment variables" icon="server">
    Store credentials in environment variables or a secrets manager — never hardcode them.
  </Card>

  <Card title="Rotate regularly" icon="rotate">
    Regenerate your API keys periodically from the Merchant Dashboard.
  </Card>

  <Card title="Restrict access" icon="shield-halved">
    Use IP allowlists and limit API key permissions to only what's needed.
  </Card>
</CardGroup>