# Authentication

> The two headers every request needs (X-API-KEY and __reseller), what authentication failures look like, and what your key can reach.

Every request needs **two headers**. Both are mandatory on every call.

| Header | Required | What to send |
| --- | --- | --- |
| `X-API-KEY` | required | Your API key. Find it in your reseller panel under API settings. |
| `__reseller` | required | Your reseller ID (a GUID). Also shown in your reseller panel next to the API key. |
| `Content-Type` | for writes | `application/json` on POST, PUT and DELETE requests that carry a body. |
| `X-Correlation-ID` | recommended | Any unique string you generate per request. We log it. Quoting it in a support ticket makes the request findable in seconds instead of minutes. |

**A complete request**

```bash
curl -X POST https://api.domainresellerapi.com/api/v1/domains/search \
  -H 'X-API-KEY: 8f2c41d7a9e5b3104c6f8a2d9b7e1c35' \
  -H '__reseller: 7f3c1a28-9e4b-4c51-b1d2-0a6e5f8c3d94' \
  -H 'X-Correlation-ID: my-app-2026-10-30-000142' \
  -H 'Content-Type: application/json' \
  -d '{"domainName":"apiname.com"}'
```

:::caution[Keep your API key secret]
The key authenticates every action on your account, including purchases that debit your balance. Never put it in browser-side JavaScript, a mobile app bundle, or a public repository. Call the API from your server only. If you think the key has leaked, regenerate it in your reseller panel immediately — the old key stops working the moment you do.
:::

## Authentication failures

These come back as **plain text**, not JSON, with HTTP 401.

| Body | What went wrong |
| --- | --- |
| `Unauthorized! API Key is missing.` | No `X-API-KEY` header. Check your client is actually sending it — some HTTP libraries drop headers on redirect. |
| `Unauthorized! ResellerId is missing.` | No `__reseller` header. Note the two leading underscores. |
| `Unauthorized! Invalid API Key.` | The key does not match the reseller ID. The usual cause is sending the test key to the live address, or the live key to the test address — see [Test environment](https://www.domainnameapi.com/docs/getting-started/#test-environment). |
| `Unauthorized! You do not have authorisation for this operation.` | The account is a sub-reseller. Only top-level reseller accounts can use this API. Your parent reseller must call it on your behalf. |

## What your key can reach

There are no scopes or permissions to configure. Your reseller ID defines what you can see: you can act on your own domains, contacts, certificates and hostings and nothing else. Asking about somebody else's domain does not return "forbidden" — it returns **not found**, because from your key's point of view it does not exist.