> ## Documentation Index
> Fetch the complete documentation index at: https://docs.calmtreasury.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> The credential on the Calm API wire and what it does.

Every request carries one credential: your **publishable key**. Each
operation's **Authorizations** panel lists it.

## The credential

| Credential      | Sent as                         | What it does         |
| --------------- | ------------------------------- | -------------------- |
| Publishable key | `x-calm-publishable-key` header | Identifies your app. |

### Publishable key

Identifies your app to Calm. It ships in your client bundle, so treat it as
public — it names your app rather than authenticating it.

Issue keys from your Calm dashboard. The value looks like
`calm_public_live_…` or `calm_public_sandbox_…`.

Every key is pinned to an allowlist of HTTPS origins. Add your app's origins
before you go live: a live key with an empty allowlist rejects every request
with `403 origin_not_allowed`. Sandbox keys stay permissive while their
allowlist is empty, so local development works without any setup.

Requests must carry an `Origin` header. Browsers send it for you; outside
sandbox, a request without one is rejected.

## Failure modes

| Code                      | Status | Meaning                                                        |
| ------------------------- | ------ | -------------------------------------------------------------- |
| `publishable_key_missing` | 400    | No `x-calm-publishable-key` header.                            |
| `validation_error`        | 400    | The key is present but malformed.                              |
| `invalid_publishable_key` | 401    | The key is not found or has been revoked.                      |
| `origin_not_allowed`      | 403    | The request `Origin` is missing or not on the key's allowlist. |