> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qonto.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Available authentication methods

> Authentication to the API is performed via HTTP, using the `Authorization` header. API requests without authentication will fail.

The Business API supports 2 authentication methods:

* [API key](https://docs.qonto.com/guides/authentication/api-key.md)
* [OAuth 2.0](https://docs.qonto.com/guides/authentication/oauth-flow.md)

Depending on who will be using your integration and which endpoints you will be calling, you could need to use OAuth 2.0 (instead of the API key).

## Which authentication method do I need?

> **You need to automate your own business**
>
> To authenticate to the Business API with your own Qonto account, you have 2 options **depending on the endpoints you will be calling** (cf. the [Scopes & endpoint access table](https://docs.qonto.com/api-reference/business-api/introduction/authentication/methods.md#which-authentication-method-do-i-need) to identify if you need to use an endpoint which is only accessible through OAuth).
>
> **API key**
>
> Follow [those steps](https://docs.qonto.com/guides/authentication/api-key.md).
>
> **OAuth 2.0**
>
> * Sign up to the [Developer Portal](https://developers.qonto.com/) to get your credentials (as well as an access to our Sandbox environment);
> * Implement the [OAuth flow](https://docs.qonto.com/guides/authentication/oauth-flow.md).

> **You need to build an integration for your customers**
>
> * Sign up to the [Developer Portal](https://developers.qonto.com/) to get your credentials (as well as an access to our Sandbox environment);
> * Implement the [OAuth flow](https://docs.qonto.com/guides/authentication/oauth-flow.md).

## Methods at a glance

| Method | Who uses it | Access | Guide |
| - | - | - | - |
| API key | Qonto customers automating their own business | Mostly read-only; a subset of endpoints | [API key](https://docs.qonto.com/guides/authentication/api-key.md) |
| OAuth 2.0 | Customers who need OAuth-only endpoints, and partners acting on behalf of users | Read/write, restricted by [scopes](https://docs.qonto.com/api-reference/business-api/introduction/authentication/scopes.md) | [Basics of the OAuth 2.0 flow](https://docs.qonto.com/guides/authentication/oauth-flow.md), [Authenticate with OAuth 2.0](https://docs.qonto.com/guides/authentication/user-oauth-flow.md), [OAuth in the Sandbox](https://docs.qonto.com/guides/authentication/oauth-sandbox.md) |

Each endpoint page shows which of these methods it accepts, and which OAuth scope(s) it requires, right below its method and URL. The full list is in [Scopes & endpoint access](https://docs.qonto.com/api-reference/business-api/introduction/authentication/scopes.md).

## Related guides

> **[Strong Customer Authentication (SCA)](https://docs.qonto.com/guides/authentication/sca-flows.md)**
>
> Sensitive actions require SCA: available flows and how to test them in the Sandbox.

> **[QSealC certificate](https://docs.qonto.com/guides/authentication/qsealc.md)**
>
> TPP identification through PSD2 QSeal certificate.

> **[Make a transfer with PSD2](https://docs.qonto.com/guides/psd2/make-a-transfer.md)**
>
> SCA, trusted beneficiaries and the PSD2 rules that apply to transfers.

> **[Create my OAuth App](https://docs.qonto.com/guides/developer-portal/create-oauth-app.md)**
>
> Get your OAuth 2.0 client credentials from the Developer Portal.