> For the complete documentation index, see [llms.txt](https://docs.metasleuth.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.metasleuth.io/blocksec-aml-api/introduction/authentication.md).

# Authentication

Every API request must include an API key. You can add IP Allowlist, Request Signing, or both in Security Settings to protect your API access.

## Get your API key

1. Sign in to [MetaSleuth](https://metasleuth.io).
2. Open [Settings → APIs → API Keys](https://metasleuth.io/system/settings/personal/apis).
3. Generate or view the API key for the service you want to use.

Address Label API and Risk Score API have separate API keys and API secrets. Use the credentials for the corresponding service.

If you obtained a customized API service through our sales team, contact your designated service representative for credentials and applicable setup instructions.

## Use your API key

Include the `Api-Key` header in every request. Keep your API key private and use it only in server-side applications. Never include it in source control, browser or mobile application bundles, URLs or logs. Use HTTPS with certificate verification enabled.

The example below reads the key from an environment variable. Avoid shell tracing (`set -x`) and verbose HTTP logging when working with credentials.

The following example uses your Risk Score API key:

```sh
curl --request GET \
  --header "Api-Key: ${MS_API_KEY}" \
  'https://aml.blocksec.com/address-compliance/api/v3/chain-list'
```

This example includes API key authentication only. If IP Allowlist is enabled, send it from an allowed public outbound IP. If Request Signing is required, also include the signature headers described in [Request Signing](/blocksec-aml-api/introduction/request-signing.md).

## Additional security checks

| Security method | Request requirement                                                                               |
| --------------- | ------------------------------------------------------------------------------------------------- |
| IP Allowlist    | The source public IP must match an allowed IP address or CIDR range.                              |
| Request Signing | Each request must include a valid signature, timestamp and unique nonce once signing is required. |
| Both            | The request must pass both checks.                                                                |

We recommend protecting your API access with at least one security method. If the API management page displays a security setup deadline, complete setup by that time to avoid interruptions. Generating a secret alone does not complete setup.

See [API Security Settings](/blocksec-aml-api/introduction/api-security-settings.md) for configuration steps and [Request Signing](/blocksec-aml-api/introduction/request-signing.md) for signing instructions.