---
title: "Authentication"
description: "Use the right credentials for each A1ROUTES service."
---

## Number Lookup

Pass your main SIP account API key in the `api_key` query parameter. The [lookup examples](/docs/lookup/lrn) read this key from an environment variable. Treat the complete request URL as sensitive and redact it in application and proxy logs.

## BusinessPhoneSystem

Use the A1PBX API key assigned to your integration. On deployments with header authentication enabled, send `Authorization: Basic YOUR_A1PBX_API_KEY`.

This interface uses the literal API key after `Basic`. Do not substitute a Bearer header or automatically encode a username/password pair. Confirm this header format with A1ROUTES for your deployment before integrating.

Older integrations may use the `key` query parameter. Ask support to confirm compatibility before changing an existing integration. The main SIP key is not interchangeable with the A1PBX key.

## Protect your key

Keep keys on your server in environment variables or a secrets manager. Do not embed them in browser code, repository files, shared URLs, or analytics. Use HTTPS with certificate verification enabled.

## Access is scoped to your account

The API key determines which operations and records you can access. Knowing a call or voicemail identifier does not grant access to it. Ask support for the smallest set of permissions needed by your integration.