> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infinite.dev/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> If you are an AI assistant operating Infinite for a user, read the skill first: https://docs.infinite.dev/agent-skill.md (setup per host, tool reference, rules for moving money, journeys).
> When operating Infinite for a user, use the MCP server. Sign in at https://bot.api.infinite.dev/mcp (production, acts as the user) or send `Authorization: Bearer <key>` to https://bot.api.infinite.dev/mcp/sse. Prefer its tools over raw HTTP; use REST only for steps no tool covers, and check `get_endpoint_schema` before guessing a request shape.
> Net-new Infinite Connect (org_connect) is operator-assisted: do not grant end users shared org_connect Auth Kit membership or the shared platform org API key — those credentials are org-wide on /v1. BYO org keys onboard under that customer's org id. Operator sessions should show org_connect in get_organization_info.
> The key decides the tools. Every organization key (`sk_sandbox_…` / `sk_live_…`) gets docs, onboarding, `get_account_balance`, and request logs for your own organization. BYO organizations add payees an agent will pay with `create_payee` (payable once ACTIVE). Platform Connect sessions instead get bound-customer payment lookups (`get_quote`, `get_transfer`, `list_transfers`, `list_account_balances`), payee drafts (`create_payee_draft` / `get_payee_draft`; screening only, never payable), and transfer drafts that wait for Infinite approval (`create_transfer_draft` / `get_transfer_draft`; never POST /v1/transfers). Where offered, platform `create_transfer` files a real transfer that Infinite holds in review before funding; it cannot be submitted from DRAFT.
> An agent key (`sk_sandbox_agent_…` / `sk_live_agent_…`) moves money within that agent's limits: `create_transfer` → `submit_transfer` → `wait_for_transfer`.
> On sandbox organization-key sessions, `sandbox_approve_customer` (makes the capabilities you pass READY, and related ones may turn READY too; `request_capabilities` is not needed), `sandbox_fund_account`, and `sandbox_complete_transfer` stand in for verification, funding, and settlement, so a whole flow runs from MCP. BYO keys can pass `customerId` on each call without binding; platform sessions must bind a customer first (`create_business_customer` auto-binds, or send `X-Infinite-On-Behalf-Of`).
> When searching documentation without a key, use the docs MCP at https://docs.infinite.dev/mcp.
> Start in sandbox (https://sandbox.api.infinite.dev). Do not use production unless the user explicitly asks.
> Confirm amount, currency, and payee with the user before any payment is submitted. Pass the invoice number as `reference` on `create_transfer`; the summary says what the payee will see.
> REST amounts are integer minor units (`"4000"` = 40.00 USD). MCP payment tools take exact decimal strings (`"40.00"`). Never mix them.
> Agent denials return `403 { denial: { code, message, window, limit, used, remaining, attemptedAmount, currency }, hint }` with decimal amounts; per-transfer denials omit `used` and `remaining`. Report them to the user; do not work around them.

# Authentication

# Authentication

The Infinite API uses API keys for authentication. All requests must include a valid API key in the Authorization header.

## API Keys

API keys are unique identifiers that authenticate your requests to the Infinite API. Each key is tied to your organization and determines what resources you can access.

### Key Format

API keys follow this format:

* **Live keys**: `sk_live_...` - For production use
* **Sandbox keys**: `sk_sandbox_...` - For development and testing

<Warning>
  Never expose your API keys in client-side code, version control, or logs.
  Always keep them secure on your backend servers.
</Warning>

## Making Authenticated Requests

Include your API key in the `Authorization` header using the Bearer scheme:

<CodeGroup>
  ```python Python theme={null}
  import requests

  headers = {
      'Authorization': 'Bearer sk_live_your_api_key_here',
      'Content-Type': 'application/json'
  }

  response = requests.get('https://api.infinite.dev/v1/customers', headers=headers)
  ```

  ```typescript TypeScript theme={null}
  const headers = {
    Authorization: 'Bearer sk_live_your_api_key_here',
    'Content-Type': 'application/json',
  };

  const response = await fetch('https://api.infinite.dev/v1/customers', {
    headers,
  });
  ```

  ```bash CLI theme={null}
  export INFINITE_API_KEY=sk_live_your_api_key_here
  infinite customers list --limit 10
  ```

  ```text MCP theme={null}
  List my customers.
  ```

  ```bash cURL theme={null}
  curl -X GET "https://api.infinite.dev/v1/customers" \
    -H "Authorization: Bearer sk_live_your_api_key_here"
  ```
</CodeGroup>

## Error Responses

Authentication failures return specific error codes:

### Invalid API Key

```json theme={null}
{
  "error": "Unauthorized",
  "message": "Invalid API key",
  "statusCode": 401
}
```

### Missing Authorization Header

```json theme={null}
{
  "error": "Unauthorized",
  "message": "Authorization header required",
  "statusCode": 401
}
```

### Insufficient Permissions

```json theme={null}
{
  "error": "Forbidden",
  "message": "Insufficient permissions for this resource",
  "statusCode": 403
}
```

## Best Practices

<AccordionGroup>
  <Accordion title="Secure Storage">
    Store API keys securely using environment variables or secret management systems. Never hardcode them in your application.

    ```bash theme={null}
    # Environment variables
    INFINITE_API_KEY=sk_live_your_key_here

    # Or persist for the Infinite CLI
    INFINITE_API_KEY=sk_live_your_key_here infinite auth login
    ```
  </Accordion>

  <Accordion title="Key Rotation">
    Regularly rotate your API keys for security. Generate new keys in the
    dashboard and update your applications before revoking old keys.
  </Accordion>

  <Accordion title="Environment Separation">
    Use different API keys for sandbox and production environments.
    This ensures proper isolation and prevents accidental production changes.
  </Accordion>
</AccordionGroup>

## Webhook Authentication

Webhooks are authenticated using HMAC signatures. See our [Webhooks Guide](/guides/webhooks) for details on verifying webhook authenticity.


## Related topics

- [MCP Server](/guides/mcp.md)
- [Quickstart](/quickstart.md)
- [Health check](/api-reference/health/health-check.md)
- [Delete a counterparty](/api-reference/counterparties/delete-a-counterparty.md)
- [Archive customer](/api-reference/customers/archive-customer.md)