> ## Documentation Index
> Fetch the complete documentation index at: https://supahooks.ar27111994.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# API authentication: Bearer tokens and query params

> Authenticate with Webhook Debugger & Logger using a Bearer token header or ?key= query parameter once authKey is configured in Actor input.

Authentication is opt-in. By default, all endpoints (including webhook ingest) are publicly accessible. To protect your instance, set `authKey` in the Actor input. Once set, the same key is enforced across all management routes and, conditionally, on the webhook ingest endpoint.

## Enabling authentication

Pass `authKey` in your Actor input to activate auth:

```json theme={null}
{
  "authKey": "your-shared-secret"
}
```

## Supported methods

Once `authKey` is configured, you can authenticate with either of the following methods on every protected request.

| Method              | Example                          |
| ------------------- | -------------------------------- |
| Bearer token header | `Authorization: Bearer YOUR_KEY` |
| Query parameter     | `?key=YOUR_KEY`                  |

<CodeGroup>
  ```bash Bearer header theme={null}
  curl -H "Authorization: Bearer your-shared-secret" \
    https://<run-id>.runs.apify.net/logs
  ```

  ```bash Query parameter theme={null}
  curl "https://<run-id>.runs.apify.net/logs?key=your-shared-secret"
  ```
</CodeGroup>

## Protected endpoints

The following endpoints require authentication when `authKey` is configured:

* `GET /`
* `GET /info`
* `GET /logs`
* `GET /logs/:logId`
* `GET /logs/:logId/payload`
* `GET /log-stream`
* `POST /replay/:webhookId/:itemId`
* `GET /system/metrics`

## Never protected

The health probes are **never** auth-protected, regardless of whether `authKey` is set. This allows container orchestrators and load balancers to probe the service without credentials.

* `GET /health`
* `GET /ready`

## Webhook ingest auth

`ANY /webhook/:id` is public by default. When `authKey` is configured, webhook ingest uses the same auth validation as management routes. This means every inbound webhook request must include a valid `Authorization: Bearer` header or `?key=` query parameter.

<Warning>
  If you secure ingest with `authKey`, ensure your webhook providers can send the required credential. Not all providers support custom auth headers — check your provider's webhook configuration options before enabling this.
</Warning>

## 401 response

When a request is missing a credential or provides an invalid one, the server returns:

```json theme={null}
{
  "error": "Unauthorized",
  "message": "Missing or invalid auth key"
}
```