> ## Documentation Index
> Fetch the complete documentation index at: https://guides.saber.money/llms.txt
> Use this file to discover all available pages before exploring further.

# API Authentication

> Generating the Saber X-Signature HMAC-SHA256 authentication token from client_id, timestamp, and client_secret for admin, user, and SDK requests.

Before using Saber's APIs or SDK, generate an authentication signature — the process differs slightly depending on the type of request.

## Receiving keys

Saber provides two key sets — sandbox and production — each with an **API Key** (`client_id`) and **API Secret** (`client_secret`). Use these to generate an authentication token (API Signature) for your requests.

<Info>
  Contact your Saber representative to get access to Saber dashboard. API Keys are generated from the dashboard.
</Info>

## Generating the authentication token

<Steps>
  <Step title="Generate a timestamp">
    ```javascript theme={null}
    var timestamp = Math.floor(Date.now() / 1000).toString();
    ```
  </Step>

  <Step title="Create the signature string">
    The signature string differs by request type:

    <Tabs>
      <Tab title="Admin Operation">
        For merchant-level requests not tied to a specific user (e.g. create a user):

        ```javascript theme={null}
        var sigString = clientId + timestamp;
        ```
      </Tab>

      <Tab title="User Operation">
        For requests tied to a specific user (e.g. create an OFFRAMP transaction):

        ```javascript theme={null}
        var sigString = clientId + timestamp + user_id;
        ```
      </Tab>

      <Tab title="Web Widget / SDK">
        For generating a token to access the hosted Web Widget:

        ```javascript theme={null}
        var sigString = clientId + timestamp + 'sdk' + user_id;
        ```
      </Tab>
    </Tabs>
  </Step>

  <Step title="Generate the HMAC-SHA256 signature">
    ```javascript theme={null}
    var signature = CryptoJS.HmacSHA256(sigString, clientSecret).toString().toUpperCase();
    ```

    The resulting `signature` can now be used to authenticate API requests.
  </Step>
</Steps>

### Full example

```javascript theme={null}
// Variables (these should be securely stored and handled)
var clientId = 'YOUR_API_KEY'; // Replace with your actual API Key
var clientSecret = 'YOUR_API_SECRET'; // Replace with your actual client secret

// Step 1: Generate timestamp
var timestamp = Math.floor(Date.now() / 1000).toString();

// Step 2: Create the signature string
var sigString = clientId + timestamp; // Admin operation (e.g. create a user)
// ------- OR -------
// var sigString = clientId + timestamp + user_id; // User operation (e.g. create OFFRAMP transaction)
// ------- OR -------
// var sigString = clientId + timestamp + 'sdk' + user_id; // Web Widget / SDK access

// Step 3: Generate the HMAC-SHA256 signature
var signature = CryptoJS.HmacSHA256(sigString, clientSecret).toString().toUpperCase();
```

## Request headers

<Note>
  The earlier header names `X-CLIENT-ID` (client ID) and `X-CLIENT-SECRET` (generated signature) have been replaced:

  | Old header        | New header    |
  | ----------------- | ------------- |
  | `X-CLIENT-ID`     | `X-API-KEY`   |
  | `X-CLIENT-SECRET` | `X-SIGNATURE` |

  You may still find the older names referenced in some documentation. We suggest using the new headers, but both work — they're backwards compatible.
</Note>

## Related pages

<CardGroup cols={2}>
  <Card title="Understanding the Platform" icon="compass" href="/getting-started/platform-intro" cta="View guide" arrow="true" />

  <Card title="Sandbox Functionality" icon="flask" href="/getting-started/sandbox" cta="View guide" arrow="true" />

  <Card title="Developer Section" icon="code" href="/client/dashboard/developers" cta="View guide" arrow="true" />
</CardGroup>


## Related topics

- [Understanding the Platform](/getting-started/platform-intro.md)
- [Welcome to Saber Money](/getting-started/welcome.md)
- [Frequently Asked Questions](/faq.md)
- [Webhook Configuration](/client/dashboard/webhooks.md)
- [Through API Endpoints](/user/bank-account/api.md)