> ## Client identification
>
> Requests to this API should include a `Client-Platform` header alongside
> `Authorization`, identifying the application, tool, or model making the
> request. This is used for integration support and analytics.
>
> Use your model or tool name, for example `claude-code` or `chatgpt`.
>
> Example:
>
> ```bash
> curl https://api.salaryboxapp.com/... \
>   -H "Authorization: Api-Key <api-key>" \
>   -H "Client-Platform: claude-code"
> ```

# Authentication

Every request must send your API key in the `Authorization` header:

```
Authorization: Api-Key {api-key}
```

Create a key in [API key management](https://web.salarybox.in/api-key-management) in the SalaryBox web app. A key gives read access to your company's data, so keep it on your
server and never put it in a browser or mobile app.

```bash
curl "https://api.salaryboxapp.com/v2/customer/v1/staff/" \
  -H "Authorization: Api-Key {api-key}"
```

## Your subscription

Your company needs an active SalaryBox subscription. Without one, every endpoint returns `403`
with `"message": "Your subscription is not active."`. Some endpoints also need Payroll Pro or an
add-on; see [Errors](/errors#plans-and-add-ons).

## Authentication errors

| Status | Body                                                          | Cause                                                                         |
| ------ | ------------------------------------------------------------- | ----------------------------------------------------------------------------- |
| `401`  | `{"detail": "Authentication credentials were not provided."}` | The `Authorization` header is missing or not in the form `Api-Key {api-key}`. |
| `401`  | `{"detail": "Invalid Api-Key"}`                               | The key is not valid, for example because it was deleted.                     |
| `403`  | `"Your subscription is not active."`                          | The company's subscription has expired.                                       |