> ## Documentation Index
> Fetch the complete documentation index at: https://docs.seyaha.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate with each Seyaha API surface.

Seyaha uses **one** authentication schemes depending on the API you're calling.

All API's endpoints require a JWT in the `Authorization` header:

```http theme={null}
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
```

**How to get a JWT:** Log in through the Seyaha platform (partner portal, reseller portal or affiliate onboarding). JWTs are short-lived — refresh them before expiry using the auth refresh endpoint.

<Warning>
  Treat your API token like a password. Never expose it in client-side code or public repositories. If compromised, contact `tech@seyaha.net` immediately.
</Warning>

## Webhooks — Webhook Secret

When your partner integration is created, Seyaha generates a `webhook_secret` and returns it in the creation response. Use it to authenticate inbound webhook calls to Seyaha:

```http theme={null}
POST /api/v1/partner-integrations/{id}/sync/trigger
x-webhook-secret: 64hex-char-secret
```

The secret is stored hashed — **it is only shown once at creation time**. If you lose it, delete and recreate the integration.

## Quick reference

| API                 | Header             | Value              |
| ------------------- | ------------------ | ------------------ |
| Partner Integration | `Authorization`    | `Bearer <JWT>`     |
| Reseller            | `Authorization`    | `Bearer <JWT>`     |
| Affiliate           | `Authorization`    | `Bearer <JWT>`     |
| Webhooks (inbound)  | `x-webhook-secret` | `<webhook secret>` |