> ## Documentation Index
> Fetch the complete documentation index at: https://docs.supermodeltools.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate your API requests

The Supermodel API uses API keys to authenticate requests. You can view and manage your API keys in the [Supermodel Dashboard](https://dashboard.supermodeltools.com/).

<Info>
  **Using the API Playground**: The interactive playground in this documentation connects to our production API. Generate an API key from the [Supermodel Dashboard](https://dashboard.supermodeltools.com/) to test endpoints directly from these docs.
</Info>

## Authentication Header

Authentication to the Data Plane API is performed via the `X-Api-Key` header.

```bash theme={null}
X-Api-Key: smsk_live_...
```

## Idempotency Key

All API requests require an `Idempotency-Key` header. This is a unique value (such as a UUID) that you generate for each request. It serves three purposes:

1. **Job identity**: The key identifies your graph generation job. Re-submitting the same key returns the existing job status rather than creating a duplicate.
2. **Polling**: You poll for results by re-submitting the same request with the same idempotency key. See [Async Polling](/async-polling) for details.
3. **Request tracing**: The key is echoed back in the `X-Request-Id` response header for debugging and support purposes.

```bash theme={null}
Idempotency-Key: 550e8400-e29b-41d4-a716-446655440000
```

You can generate a UUID in most languages or use command-line tools like `uuidgen`.

## Example Request

Here's how to include the headers in a cURL request:

```bash theme={null}
curl --request POST \
  --url https://api.supermodeltools.com/v1/graphs/dependency \
  --header "Idempotency-Key: $(uuidgen)" \
  --header 'X-Api-Key: <your-api-key>' \
  --header 'Content-Type: multipart/form-data' \
  --form file='@./repo.zip'
```

<Warning>
  Your API keys carry many privileges, so be sure to keep them secure! Do not share your secret API keys in publicly accessible areas such as GitHub, client-side code, and so forth.
</Warning>