> ## Documentation Index
> Fetch the complete documentation index at: https://help.honestly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Honestly Export API: Authentication and API Keys

> Honestly uses API key authentication. Include your X-Api-Key header on every request to the Export API. Learn how to get and use your key.

Every request to the Honestly Export API must be authenticated using an API key. You supply this key via the `X-Api-Key` HTTP request header — all endpoints require this header to be present and valid before they will return data. Requests made without a key, or with an invalid key, will be rejected with a `401 Unauthorized` response.

## Getting your API key

API keys are provisioned on a per-customer basis inside of the account by your Honestly admin.

<Note>
  Keep your API key secure. Do not share it with unauthorised parties, and never commit it to version control or include it in client-side code.
</Note>

## Using your API key

Once you have your key, include it as a header on every API request:

```text theme={null}
X-Api-Key: YOUR_SECRET_API_KEY
```

Here is a complete example using `curl`:

```bash theme={null}
curl -X GET "https://api.honestly.com/v1/surveys" \
  -H "X-Api-Key: YOUR_SECRET_API_KEY"
```

Replace `YOUR_SECRET_API_KEY` with the actual key you received. The same header must be included on every call, regardless of the endpoint you are targeting.

## Security best practices

<Warning>
  If you suspect your API key has been compromised, immediately revoke the existing key and issue a replacement within the account
</Warning>

Follow these practices to keep your integration secure:

* **Use environment variables** — Store your API key in an environment variable or a secrets manager rather than hardcoding it in your source code.
* **Never commit keys to version control** — Ensure `.env` files and configuration files containing keys are listed in your `.gitignore`.
* **Rotate keys periodically** — Request a fresh key from your Customer Success manager on a regular schedule to limit the impact of undetected exposure.
* **Restrict access** — Only grant API key access to the systems and team members that genuinely require it. Avoid sharing a single key across multiple unrelated projects.

## Authentication errors

| Status code                 | Meaning                                                                                                                                     |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| `401 Unauthorized`          | The `X-Api-Key` header is missing, empty, or contains an invalid key.                                                                       |
| `400 Bad Request`           | The request is malformed. Check the response body for a detailed error message describing what needs to be corrected.                       |
| `500 Internal Server Error` | An unexpected error occurred on the server. These are typically transient — retry your request using exponential backoff before escalating. |