> For the complete documentation index, see [llms.txt](https://docs.cloutly.com/reviews-sdk-for-marketplace-websites/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cloutly.com/reviews-sdk-for-marketplace-websites/introduction/authentication.md).

# Authentication

Use two auth methods depending on integration type:

## REST API authentication (`x-api-key`)

Authenticate all REST calls with your API key in request headers.

```
x-api-key: YOUR_API_KEY_HERE
```

The key is long-lived and remains valid until rotated from the console.

## Cloutly Embed authentication (signed JWT)

For iframe embed sessions, your backend signs a short-lived JWT using your Cloutly embed signing key.

Required claims include:

* `externalUserEmail`
* `externalBusinessId`
* `businessDisplayName`
* `firstName`
* `lastName`
* `role`
* `smsLimits`
* `iat`
* `exp`

JWT tokens should be issued server-side only and expired quickly.