Source: https://docs.debitura.com/developer-concepts/authentication

# Authentication

All Debitura APIs require authentication. The method varies by API and integration type.

<a id="quick-reference"></a>

## Quick Reference

| Segment | API | Auth Method | Header | Where to Get Keys |
| --- | --- | --- | --- | --- |
| Clients | Customer API | API Key | `XApiKey` | [Creditor Portal](https://app.debitura.com/CreditorApiKey) |
| Referral Partners | Referral Partner API | API Key | `XApiKey` | Contact [partnerships@debitura.com](mailto:partnerships@debitura.com) |
| Referral Partners | Customer API (via token) | JWT Bearer | `Authorization: Bearer` | `POST /oauth/token` |
| Collection Partners | Collection Partner API | API Key | `XApiKey` | [Partner Portal](https://partner.debitura.com/CollectionPartnerApiKey/Index) |

<a id="common-error-codes"></a>

## Common Error Codes

| Code | Meaning |
| --- | --- |
| `401 Unauthorized` | Missing or invalid API key/token |
| `403 Forbidden` | A Referral Partner test-only operation was called in production |

For segment-specific details, see [Client Authentication](https://docs.debitura.com/clients/getting-started/authentication.md), [Referral Partner Authentication](https://docs.debitura.com/referral-partners/getting-started/authentication.md), or [Collection Partner Authentication](https://docs.debitura.com/collection-partners/getting-started/authentication.md).