> For the complete documentation index, see [llms.txt](https://skymerse.gitbook.io/notamify-api/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://skymerse.gitbook.io/notamify-api/basics/authentication-guide.md).

# Authentication guide

### Overview

Security is paramount when working with aviation data. Notamify enforces robust authentication methods and industry-standard security practices to keep your information safe. This guide covers:

* Authentication methods
* Best practices for handling your API key
* SSL/TLS considerations
* Error handling for authentication failures

#### 0. Generate API key

You can generate your API key in <https://notamify.com/api-manager>

#### 1. API Key Authentication

All requests to the Notamify API require an API key passed as a **Bearer Token**:

```http
Authentication: Bearer YOUR_API_KEY
```

#### Using the Python SDK

The [Notamify Python SDK](https://github.com/skymerse/notamify-sdk-python) handles authentication automatically. Pass the token directly:

```python
from notamify_sdk import NotamifyClient

client = NotamifyClient(token="YOUR_API_KEY")
```

Or use environment variables and config files for zero-code auth:

```python
from notamify_sdk import NotamifyClient, ConfigStore

# Loads token from NOTAMIFY_TOKEN env var or ~/.config/notamify/config.json
cfg = ConfigStore().load()
client = NotamifyClient(token=cfg.token)
```

**Config resolution order** (first match wins):

1. `NOTAMIFY_TOKEN` environment variable
2. Config file at `NOTAMIFY_CONFIG_FILE` env var path, or `~/.config/notamify/config.json`

> **Tip:** Make sure to only send your API requests over HTTPS.

#### 2. API Key Security Best Practices

* **Never hard-code** your API key in public repositories.
* **Rotate** your API keys regularly, especially if there is any suspicion of compromise.
* **Use environment variables** or secure vaults (like HashiCorp Vault or AWS Secrets Manager) to store and retrieve keys at runtime.
* **Enforce IP restrictions** (Enterprise-level feature) to limit which IPs can use your keys.

#### 3. SSL/TLS Requirements

All Notamify API endpoints are served exclusively over secure SSL/TLS connections (`https`). Requests made over unencrypted HTTP will fail automatically.

> **Note:** If your system requires a custom certificate bundle or is behind a corporate proxy, ensure that all `.crt` or `.pem` files are up to date and correctly configured.

#### 4. Handling Authentication Errors

If your request is missing the key or uses an invalid key, you will receive a `401 Unauthorized` response. For example:

```json
{
  "status": "error",
  "message": "Invalid or missing API key."
}
```

**Troubleshooting Steps**

* Verify you are using the correct key in the request header: `Authentication: Bearer YOUR_API_KEY`
* Ensure your key has not expired or been revoked.
* Contact [**Notamify Support**](https://notamify.com/contact) if you continue to experience issues.