> For the complete documentation index, see [llms.txt](https://docs.resmic.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.resmic.com/resmic-pro/api-authentications-and-security.md).
# API Authentications & Security
### Introduction
Resmic Pro requires an API key for secure access to its payment services. This section explains how to obtain and use your API key while ensuring best security practices.
### Step 1: Subscription Requirement
Before generating an API key, users must have an active subscription. You can either:
* **Buy a plan** from the dashboard.
* **Start a free 20-day trial** to test the service.
### Step 2: Generating an API Key
1. Log in to your Resmic Pro dashboard.
1. Navigate to the **Developer** section.
2. If you have an active plan, click on **Generate Key**.
3. Copy and securely store your `API_KEY` & `User_id` It will only be shown once.
### Step 3: Using Your API Key
Your API key must be included in the `Authorization` header of every request:
{% hint style="warning" %}
Representational, Not an actual endpoint
{% endhint %}
```
curl -X POST "https://api.resmic.com/payments" \
-H 'x-api-key': ,
'x-user-id':
```
### Step 4: Security Best Practices
* **Keep your API key confidential** – Do not expose it in frontend code or public repositories.
* **Rotate API keys periodically** – Generate a new key and update your integrations regularly.
* **Use environment variables** – Store API keys in `.env` files instead of hardcoding them.
### Step 5: Regenerating or Revoking an API Key
1. Go to the **API Keys** section in your dashboard.
2. Click on **Revoke** to disable an existing API key.
3. Generate a new key if needed and update your application accordingly.
### Conclusion
Your `API_KEY` and `User_Id`is essential for integrating with Resmic Pro securely. Follow the best practices to protect your key and ensure seamless transactions. For more details, refer to the API Documentation.