> ## Documentation Index
> Fetch the complete documentation index at: https://docs.playstarters.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate Operator API requests with your PlayStarters API key using the ApiKey scheme.

The Operator API authenticates every request using a static API key passed in the `Authorization` header.

## Format

```text theme={null}
Authorization: ApiKey ps_<your_api_key>
```

The PlayStarters team provides the key during onboarding. Keep it secret.

## Example

```bash theme={null}
curl https://api.playstarters.io/operator/providers \
  -H "Authorization: ApiKey ps_YOUR_API_KEY"
```

## Authentication errors

| HTTP Status        | Cause                                                                    |
| ------------------ | ------------------------------------------------------------------------ |
| `401 Unauthorized` | The `Authorization` header is missing, malformed, or the key is invalid. |
| `403 Forbidden`    | The key is valid but not authorized for the requested resource.          |

<Warning>
  Never commit API keys to source control or expose them in client-side code. Load them from environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, etc.).
</Warning>

<Note>
  Authentication for the **Seamless Wallet API** (calls from PlayStarters to your backend) uses the same API key, but sent as a `Bearer` token: `Authorization: Bearer ps_<your_api_key>`. See the [Wallet Overview](/api/wallet/overview).
</Note>

<Warning>
  **What should your wallet return if the Bearer token is invalid?**\
  Return HTTP `401 Unauthorized`. Playstarters will treat this as a fatal error and will not retry.
</Warning>

<Danger>
  If the API key is missing, invalid, or belongs to an inactive site, the API returns **HTTP 401 Unauthorized**.
</Danger>

<Tip>
  **Naming conventions:**

  * **Operator API** (your calls → Playstarters):\
    uses **camelCase** (`gameId`, `playerId`, etc.)
  * **Seamless Wallet API** (Playstarters calls → you): \
    also uses **camelCase** (`playerId`, `requestId`, `parentTransactionId`, etc.)
</Tip>