API Authentication

Every Core API request must carry credentials. Use one of two methods.

Method	Header	Use for
API key	`x-api-key: <key>`	Service integrations, such as backend systems calling Knova
Bearer token	`Authorization: Bearer <JWT>`	Requests made on behalf of an authenticated user

curl https://<your-knova-host>/v1/... \
  -H "x-api-key: $KNOVA_API_KEY"

Keep keys server-side. Don't put an API key in browser or mobile code.
Use HTTPS for every request.
Rotate keys by asking your Knova contact to issue a new one, switching over, then retiring the old one.

The x-api-key header here is a key you send to Knova. It's a different thing from the x-api-key header Knova can send you on webhooks. See Webhook Security.