> ## Documentation Index
> Fetch the complete documentation index at: https://docs.virtualityhub.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate V-Run API requests with a per-workflow API key passed in the x-api-key header. Includes code samples in Python, JavaScript, and cURL.

## API key authentication

Every workflow in V-Run has a unique API key. This key authenticates external requests to trigger that workflow.

### Finding your API key

1. Open the workflow in the editor.
2. Switch to the **API Trigger** tab in the left panel.
3. Your API key is displayed and can be copied.

### Using the API key

Pass the key in the `x-api-key` header on every request:

```bash theme={null}
curl -X POST https://run.virtualityhub.com/api/workflows/{workflowId}/execute \
  -H "x-api-key: wk_abc123def456" \
  -H "Content-Type: application/json" \
  -d '{"input_param": "value"}'
```

<CodeGroup>
  ```python Python theme={null}
  import requests

  response = requests.post(
      "https://run.virtualityhub.com/api/workflows/{workflowId}/execute",
      headers={
          "x-api-key": "wk_abc123def456",
          "Content-Type": "application/json",
      },
      json={"input_param": "value"},
  )

  print(response.json())
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch(
    "https://run.virtualityhub.com/api/workflows/{workflowId}/execute",
    {
      method: "POST",
      headers: {
        "x-api-key": "wk_abc123def456",
        "Content-Type": "application/json",
      },
      body: JSON.stringify({ input_param: "value" }),
    }
  );

  const data = await response.json();
  console.log(data);
  ```

  ```bash cURL theme={null}
  curl -X POST \
    https://run.virtualityhub.com/api/workflows/{workflowId}/execute \
    -H "x-api-key: wk_abc123def456" \
    -H "Content-Type: application/json" \
    -d '{"input_param": "value"}'
  ```
</CodeGroup>

## Security best practices

<Warning>
  Treat your API key like a password. Never commit it to source control, embed it in client-side code, or share it publicly.
</Warning>

* **Store keys in environment variables** on your server, not in code.
* **Rotate keys** if you suspect they have been compromised. Generate a new key from the workflow editor.
* **Use HTTPS only** — all API traffic must use TLS encryption.
* **Scope access** — each workflow has its own key, so a compromised key only affects one workflow.