> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cngn.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, environments, and IP whitelisting

Every request to the cNGN API must be authenticated with an API key sent as a Bearer token:

```bash theme={null}
Authorization: Bearer cngn_live_xxxxxxxxxxxxx
```

## Environments

The API key prefix determines the environment. Both environments use the same base URL (`https://api.cngn.co/v1/api`):

| Environment | Key prefix  | Behaviour                                       |
| ----------- | ----------- | ----------------------------------------------- |
| **Test**    | `cngn_test` | Sandbox data; safe for integration testing      |
| **Live**    | `cngn_live` | Production; real funds and real bank settlement |

Each environment has its own independent set of credentials:

* **API key**: identifies your business
* **Encryption key**: AES key used to encrypt request bodies
* **Ed25519 SSH public key**: used by the API to encrypt response payloads to you

A key from one environment never works against the other's data. Using a token without a recognised prefix fails with `Invalid token prefix`.

## IP whitelisting

After the API key check, the request's source IP is validated against your whitelist. Requests from non-whitelisted addresses are rejected:

```json theme={null}
{
  "status": 403,
  "message": "IP address not whitelisted"
}
```

Manage the whitelist from your merchant dashboard. Remember to add every egress IP your infrastructure uses (load balancers, NAT gateways, serverless egress ranges).

## Authentication errors

| Message                                           | Cause                                               |
| ------------------------------------------------- | --------------------------------------------------- |
| `No token provided`                               | Missing `Authorization` header                      |
| `Invalid token prefix`                            | Key doesn't start with `cngn_test` or `cngn_live`   |
| `Merchant not found`                              | Key not recognised (revoked or mistyped)            |
| `No Test SSH Key found` / `No Live SSH Key found` | No Ed25519 public key uploaded for that environment |
| `IP address not whitelisted`                      | Request came from a non-whitelisted IP              |

## Key rotation and safety

<Tip>
  * Store keys in a secrets manager, never in code or client-side bundles.
  * Rotate keys immediately if you suspect exposure: generate a new key in the dashboard and update your deployment.
  * Use test keys everywhere except production infrastructure.
</Tip>