> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bolta.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate with the Bolta API and use request headers.

<Note>
  Some links point to the service guide, which is currently available in Korean only.
</Note>

## API key authentication (Basic Auth)

The Bolta API uses HTTP Basic Authentication. Base64-encode your API key and include it in the `Authorization` header.

```bash theme={"dark"}
Authorization: Basic {Base64(API_KEY:)}
```

<Warning>
  You must append a colon (`:`) after the API key before Base64-encoding it.
</Warning>

**Example**

```bash theme={"dark"}
# When the API key is test_abc123
# Base64("test_abc123:") = dGVzdF9hYmMxMjM6

curl -X POST https://xapi.bolta.io/v1/taxInvoices/issue \
  -H "Authorization: Basic dGVzdF9hYmMxMjM6" \
  -H "Content-Type: application/json"
```

## Test key vs. live key

| Type     | Prefix  | Purpose                                       |
| -------- | ------- | --------------------------------------------- |
| Test key | `test_` | Sandbox environment, not connected to the NTS |
| Live key | `live_` | Production environment, connected to the NTS  |

Tax invoices issued with a test key are not reported to the National Tax Service (NTS). Always use a test key during development and testing.

> For how to issue an API key, see the [API key guide](/docs/developer-center/api-key).

## Request headers

### Supplier-Key

A header that identifies the **supplier** itself that issues the tax invoice. Pass the `supplierKey` value obtained from the [Register Supplier API](/api-reference/supplier/register-supplier).

```bash theme={"dark"}
Supplier-Key: SupplierKey_bf8paz
```

<Info>
  Each `supplierKey` is managed independently per API key. A `supplierKey` created under a test key and one created under a live key are different values and are not interchangeable.
</Info>

<Warning>
  **`Supplier-Key` is the key of the supplier (issuer) itself.**

  The information of the recipient (supplied party) that receives the tax invoice goes in the `supplied` field of the request body, not in the `Supplier-Key` header. Be careful not to pass the recipient's key into `Supplier-Key` by mistake.
</Warning>

### Client-Reference-Id

A header that guarantees the idempotency of a request. If you send a duplicate request with the same `Client-Reference-Id`, the existing result is returned.

```bash theme={"dark"}
Bolta-Client-Reference-Id: your-unique-reference-id
```

If you did not receive a response due to a network error or similar, re-sending with the same ID prevents duplicate issuance.