{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-products/directdebit/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Authentication - Monato Direct Debit API","siteUrl":"https://docs.monato.com","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"authentication","__idx":0},"children":["Authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["All requests to the Monato Direct Debit API must be authenticated using an API key passed in the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["x-api-key"]}," request header."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"generating-api-keys","__idx":1},"children":["Generating API Keys"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["API keys are generated self-service from the Monato Portal under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → API Keys"]},". There is no approval process — keys are active immediately upon creation."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Separate keys are available for the sandbox and production environments. You can generate multiple keys per environment, which is useful for isolating keys per integration or service."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"passing-your-api-key","__idx":2},"children":["Passing Your API Key"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Include your API key in every request using the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["x-api-key"]}," header:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"curl -X POST https://directdebit.monato.com/charges \\\n  --header 'Content-Type: application/json' \\\n  --header 'x-api-key: YOUR_API_KEY' \\\n  --data '{ ... }'\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Requests made without a valid API key will receive a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["401 Unauthorized"]}," response."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"key-security-best-practices","__idx":3},"children":["Key Security Best Practices"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Never expose API keys in client-side code"]},", public repositories, or logs."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Store keys in environment variables or a secrets manager, not in configuration files."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Use separate keys for sandbox and production environments."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Rotate keys immediately if you suspect a key has been compromised — you can revoke and regenerate keys from the Portal at any time."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["If running multiple services, consider generating a dedicated key per service so you can revoke individual access without affecting others."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"webhook-endpoint-authentication","__idx":4},"children":["Webhook Endpoint Authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Webhook delivery uses a separate authentication mechanism. Rather than API keys, the platform sends an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Authorization"]}," HTTP header with a value you configure during onboarding. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/directdebit/content/guides/api/webhooks#endpoint-authentication"},"children":["Webhooks"]}," for details."]}]},"headings":[{"value":"Authentication","id":"authentication","depth":1},{"value":"Generating API Keys","id":"generating-api-keys","depth":2},{"value":"Passing Your API Key","id":"passing-your-api-key","depth":2},{"value":"Key Security Best Practices","id":"key-security-best-practices","depth":2},{"value":"Webhook Endpoint Authentication","id":"webhook-endpoint-authentication","depth":2}],"frontmatter":{"seo":{"title":"Authentication - Monato Direct Debit API"}},"lastModified":"2026-06-23T21:56:40.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/directdebit/content/getting-started/authentication","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}