> ## Documentation Index
> Fetch the complete documentation index at: https://developer.omni.z-api.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to generate and use your API credentials in Omni Z-API

export const frontendUrl = 'https://app.omni.z-api.io';

export const projectName = 'Omni Z-API';

## API Credentials

Unlike Z-API which uses the `Client-Token` header, {projectName} works with a key pair: **Public Key** and **Secret Key**.

To generate your credentials, go to the **Security** menu in the dashboard: [Security](\{frontendUrl}/app/security).

***

## Public Key

The Public Key is used **exclusively** by the channel connection SDK. With it, you can connect channels (such as WhatsApp, Telegram, etc.) directly within your system, without needing to access the {projectName} dashboard.

<Note>
  The Public Key can be exposed in your application's frontend, as it has limited permissions for channel connection only.
</Note>

Example usage with the SDK:

```javascript theme={null}
import { OmniZapi } from '@omni-zapi/connect';

const omni = new OmniZapi({
  publicKey: 'YOUR_PUBLIC_KEY'
});
```

<Tip>
  Install the SDK via npm: [`@omni-zapi/connect`](https://www.npmjs.com/package/@omni-zapi/connect)
</Tip>

***

## Secret Key

The Secret Key is used for authentication in {projectName} APIs. It must be sent in the `Authorization` header as a Bearer token.

<Warning>
  The Secret Key must **never** be exposed in the frontend. Use it only in your application's backend.
</Warning>

Example usage in API calls:

```bash theme={null}
curl -X POST https://api.omni.z-api.io/channels/YOUR_CHANNEL/token/YOUR_TOKEN/send-text \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_SECRET_KEY" \
  -d '{"phone": "5511999999999", "message": "Hello!"}'
```

***

## Summary

| Key            | Usage                              | Can expose in frontend? |
| -------------- | ---------------------------------- | ----------------------- |
| **Public Key** | Channel connection SDK             | Yes                     |
| **Secret Key** | API calls (`Authorization` header) | No, backend only        |