# Authentication

Send two headers on every request. `X-API-Key` works like a username and `X-API-Secret` like a password. Create the pair on the **API keys** page of the dashboard; the secret is shown **only once** and is not stored in plain text.

```bash
curl https://ulawk.com/api/v1/sirketler/ \
  -H "X-API-Key: ulk_DENEME_ANAHTARINIZ" \
  -H "X-API-Secret: ulsk_DENEME_GIZLI_ANAHTARINIZ"
```

## Key types

| Type | What it sees |
|---|---|
| Live | Only the companies you follow. Adding uses your allowance. |
| Sandbox | Only made-up DENEME-… companies; never touches live data, your plan or the registry. Responses carry `X-Ulawk-Ortam: deneme`. ([Sandbox](/en/gelistirici/deneme-ortami/)) |

## Rules

- A wrong or missing secret returns `401 yetkisiz`.
- Requests that create, change, delete or test webhooks work **with an API key only**; browser sessions are refused (`403 anahtar_gerekli`).
- MCP takes the same pair as `Authorization: Bearer KEY:SECRET`; MCP does not accept sandbox keys ([MCP](/en/gelistirici/mcp/)).
- Older keys created before secrets existed keep working on their own; use a pair for new integrations.
- Never put keys in browser code, mobile apps or public repositories; call from your server.