---
title: Authentication
description: Authenticate OrbitRail Events API requests with the X-OrbitRail-Key header.
url: https://pr-1-3b5c652a9824.thally.app/api/authentication
---

# Authentication

Authenticate OrbitRail Events API requests with the X-OrbitRail-Key header.

Every OrbitRail Events API request must include an `X-OrbitRail-Key` header containing your API key.

## Header format

```text
X-OrbitRail-Key: your-api-key
```

## Example request

```bash
curl -X POST https://events.orbitrail.example/v1/events \
  -H "X-OrbitRail-Key: $ORBITRAIL_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"type": "order.completed", "payload": {"orderId": "ord_123"}}'
```

## Using the SDK constant

The `@orbitrail/events` package exports the header name as a constant so you never need to hard-code it:

```typescript
import { deliveryPolicy } from "@orbitrail/events";

const headers = {
  [deliveryPolicy.authenticationHeader]: process.env.ORBITRAIL_API_KEY!,
  // deliveryPolicy.authenticationHeader === "X-OrbitRail-Key"
};
```

## Required on all endpoints

The `X-OrbitRail-Key` header is required on every endpoint:

| Endpoint | Method |
|---|---|
| `/v1/events` | `POST` (publish) |
| `/v1/events/{eventId}/replay` | `POST` (replay) |
| `/v1/events/{eventId}` | `GET` (delivery status) |