> ## Documentation Index
> Fetch the complete documentation index at: https://supahooks.ar27111994.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate requests with an API key

> Use authKey to protect your dashboard, management routes, and webhook ingest endpoints from unauthorized access with a shared secret.

By default, all generated webhook URLs and management endpoints are publicly accessible. Anyone with your run URL can view logs, replay events, or post to your webhook endpoints. Setting `authKey` locks down those routes behind a shared secret that callers must present on every request.

<Warning>
  Webhook URLs are public unless you enable `authKey`, `allowedIps`, or signature verification. Do not point sensitive production traffic to unsecured endpoints.
</Warning>

## Set the auth key in actor input

Add `authKey` to your actor input. The field is marked `isSecret` in the input schema, so the Apify UI stores and displays it as a masked value.

```json theme={null}
{
  "urlCount": 1,
  "retentionHours": 24,
  "authKey": "your-secret-key-here",
  "maskSensitiveData": true
}
```

You can also pass the full input as an environment variable for local or Docker runs:

```bash theme={null}
INPUT='{"urlCount":1,"authKey":"your-secret-key-here"}' npm start
```

## Pass the key on every request

The actor accepts the key in two ways. Use whichever fits your client best.

<CodeGroup>
  ```bash Bearer token header theme={null}
  curl https://<run-id>.runs.apify.net/logs \
    -H "Authorization: Bearer your-secret-key-here"
  ```

  ```bash Query parameter theme={null}
  curl "https://<run-id>.runs.apify.net/logs?key=your-secret-key-here"
  ```
</CodeGroup>

Both methods work on all protected endpoints. The query parameter is convenient for quick browser tests; prefer the `Authorization` header for automated clients.

## Which endpoints are protected

When `authKey` is set, the following management endpoints require authentication:

| Endpoint                          | Purpose                             |
| --------------------------------- | ----------------------------------- |
| `GET /`                           | Dashboard page                      |
| `GET /info`                       | Runtime info and endpoint discovery |
| `GET /logs`                       | Query captured events               |
| `GET /logs/:logId`                | Fetch a single log entry            |
| `GET /logs/:logId/payload`        | Retrieve the stored payload         |
| `GET /log-stream`                 | Live SSE event stream               |
| `POST /replay/:webhookId/:itemId` | Replay a captured event             |
| `GET /system/metrics`             | Sync and operational metrics        |

`/webhook/:id` ingest is **public by default**, but it is also protected once you set `authKey`. Senders must include the key when posting to your webhook URLs.

The two health probe endpoints are **never** protected regardless of your `authKey` setting:

| Endpoint      | Purpose         |
| ------------- | --------------- |
| `GET /health` | Liveness probe  |
| `GET /ready`  | Readiness probe |

This lets container orchestrators and load balancers probe your instance even when all management routes require authentication.

## Auth failure response

A missing or invalid key returns a `401` JSON response:

```json theme={null}
{
  "error": "Unauthorized",
  "message": "Missing or invalid authentication key"
}
```

## Mask sensitive headers and body fields

Even with `authKey` enabled, captured events may contain credentials in request headers or body fields. Two input settings help keep those values out of your logs.

### `maskSensitiveData`

When enabled (the default), the actor automatically redacts `Authorization`, `Cookie`, `Set-Cookie`, and similar API key headers before writing the captured event to storage. The header key is retained in the log but the value is replaced with a redacted placeholder.

```json theme={null}
{
  "maskSensitiveData": true
}
```

### `redactBodyPaths`

Use `redactBodyPaths` to redact specific fields from JSON request bodies. Values are dot-notation paths that must start with `body.`.

```json theme={null}
{
  "redactBodyPaths": [
    "body.token",
    "body.user.password",
    "body.payment.card"
  ]
}
```

The actor replaces matching field values with a redacted placeholder before storage. The field keys remain visible in the log.

## Full example with auth and masking

```json theme={null}
{
  "urlCount": 1,
  "retentionHours": 48,
  "authKey": "your-secret-key-here",
  "maskSensitiveData": true,
  "redactBodyPaths": [
    "body.token",
    "body.user.password"
  ]
}
```

Call a protected endpoint using a Bearer token:

```bash theme={null}
curl https://<run-id>.runs.apify.net/info \
  -H "Authorization: Bearer your-secret-key-here"
```