> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airlead.de/llms.txt
> Use this file to discover all available pages before exploring further.

# API authentication

> Authenticate partner webhook calls to Airlead.

# API authentication

Airlead uses resource-specific webhook secrets. There is no workspace-wide public API key for the endpoints in this reference.

## Send the secret

Use either supported form:

```http theme={null}
X-Airlead-Webhook-Secret: YOUR_SECRET
Content-Type: application/json
```

or:

```http theme={null}
Authorization: Bearer YOUR_SECRET
Content-Type: application/json
```

## Select the correct credential

* **Lead ingest:** use the secret configured for that source. It is required when the source has one configured.
* **Buyer lifecycle callbacks:** use the webhook secret of the buyer associated with the transaction.
* **Supplier cancellation confirmation:** use the supplier credential agreed for that lead flow.

Do not interchange source and buyer secrets.

## Security requirements

* Use TLS.
* Store secrets in a secret manager or environment variable.
* Never include secrets in URLs, client-side code, logs, or support messages.
* Use separate credentials per environment.
* Rotate exposed credentials before sending more traffic.