# Authentication

Partner endpoints authenticate with an API key. Do not use Cognito session tokens or OAuth.

## Header

Send the key on every request:

```http
x-api-key: pk_your_partner_key
```

Example:

```bash
curl -X POST "https://api.example.com/partner/agents/status" \
  -H "x-api-key: pk_your_partner_key" \
  -H "Content-Type: application/json" \
  -d '{"agentId":"us-east-1:11111111-1111-1111-1111-111111111111","enabled":false}'
```

## Network scoping

Each API key is bound to a single `networkId` in AWS Secrets Manager. The API:

- Rejects keys that are missing or unknown (`401`)
- Only loads agents that belong to that network (`404` if the agent is in another network)

You cannot act on agents outside your network.

## Key storage

Keys are issued by LeadArena and stored as a JSON map:

```json
{
  "partner-keys": {
    "pk_abc123": { "networkId": "NETWORK_UUID", "name": "Partner A" }
  }
}
```

Do not put API keys in client-side apps, source control, or logs.