> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airlead.de/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate source ingest, buyer lifecycle, and Connect integrations.

# Authentication

## Webhook headers

Airlead webhook endpoints accept a configured secret in either header:

```http theme={null}
X-Airlead-Webhook-Secret: <secret>
```

```http theme={null}
Authorization: Bearer <secret>
```

Send `Content-Type: application/json` with JSON requests.

## Source ingest secret

Each webhook source can have its own ingest secret.

* If a secret is configured, every request must provide it.
* If no secret is configured, that source accepts requests without this credential.

Always configure a strong, unique secret before production traffic.

## Buyer lifecycle secret

Confirmation, rejection, payout, and cancellation callbacks use the webhook secret of the buyer associated with the transaction.

* Invalid or missing credentials return `401`.
* If the buyer has no required secret configured, the endpoint can return `403`.

Do not use a source secret for buyer lifecycle calls.

## Connect secret

A Connect endpoint can require a separate Connect secret. When enabled, the sender must provide it while resolving or delivering to that endpoint.

## Store and rotate secrets safely

* Store secrets in an encrypted secret manager or environment variable.
* Never commit them to source control.
* Never include them in URLs.
* Redact headers from logs and error reports.
* Use different secrets for development, staging, and production.
* Rotate a secret immediately if it is exposed.
* Coordinate rotation to avoid losing production deliveries.

## In-app APIs

The Airlead web app uses user sessions and permissions for its own endpoints. A browser session or internal application credential is not a supported partner API authentication method.

Next: [API authentication](/api-reference/authentication) · [Errors, retries, and limits](/developers/rate-limits-errors)