> ## Documentation Index
> Fetch the complete documentation index at: https://developer.pagou.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate Pagou API requests consistently and choose one production standard for your integration.

Every Pagou API request requires authentication.

## Supported methods

1. `Authorization: Bearer <token>`
2. `apiKey: <token>` header
3. Basic Auth with username `token` and password `x`

Use one method across all services. Bearer token is the recommended default for new integrations.

## Recommended request

```http theme={null}
GET /v2/transactions HTTP/1.1
Host: api.pagou.ai
Authorization: Bearer YOUR_TOKEN
```

## Example response

```json theme={null}
{
  "success": true,
  "requestId": "0190a2b4-18a7-7de0-9a43-69b7cf261201",
  "data": {
    "data": [],
    "total": 0,
    "next_cursor": null,
    "prev_cursor": null
  }
}
```

## Compatibility examples

```http theme={null}
GET /v2/transactions HTTP/1.1
Host: api.pagou.ai
apiKey: YOUR_TOKEN
```

```http theme={null}
GET /v2/transactions HTTP/1.1
Host: api.pagou.ai
Authorization: Basic dG9rZW46eA==
```

## Common error

Status `401`

```json theme={null}
{
  "type": "https://api.pagou.ai/problems/unauthorized",
  "title": "Unauthorized",
  "status": 401,
  "detail": "Authentication credentials were not provided or are invalid."
}
```

Fix: confirm the token belongs to the selected environment and that you are not mixing auth schemes across services.

## Operational rules

* Rotate credentials in your secret manager, not in source code.
* Never log tokens.
* Keep browser code on public keys only. Secret API tokens stay on the backend.

## Next steps

* [Idempotency](/start-here/idempotency)
* [Errors and Retries](/start-here/errors-and-retries)