# Authentication

Send your API key in the `X-API-KEY` header on every request:

```http
GET /api/v1/user HTTP/1.1
Host: api.gmjroaming.com
X-API-KEY: your-api-key
Accept: application/json
```

| Response | Meaning |
| --- | --- |
| `401` `{"message":"API key is missing"}` | No `X-API-KEY` header. |
| `403` `{"message":"Invalid API key"}` | The key is wrong or was rotated. |

:::warning
Your key can spend your balance. Keep it on your server. Never put it in a mobile app, browser
code or a public repository. If it leaks, rotate it in the console right away.
:::

Every request acts on the account that owns the key. You can only see and manage eSIMs and
transactions that belong to that account.