> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lomadee.com.br/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate

> How to use a partner x-api-key

The Partner API authenticates with the `x-api-key` header. The value is a **v2** key of type `partner`.

## Header

```http theme={null}
GET /api/partner/brands HTTP/1.1
Host: api.lomadee.com.br
x-api-key: lmd_prod_xxxxxxxxxx_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

Do not send a JWT (`x-api-token`) or the SDK `x-auth-key`.

## Scopes

| Scope                | Routes                                                                  |
| -------------------- | ----------------------------------------------------------------------- |
| `organizations:read` | `GET /api/partner/organizations`                                        |
| `brands:read`        | `GET /api/partner/brands`, `GET /api/partner/brands/{brandId}`          |
| `campaigns:read`     | `GET /api/partner/campaigns`, `GET /api/partner/campaigns/{campaignId}` |

Older partner keys may only have `organizations:read`. Without the route scope, the API returns `403`.

## Errors

| Status | Cause                                                     |
| ------ | --------------------------------------------------------- |
| `401`  | Missing header, invalid key, or type other than `partner` |
| `403`  | Valid key without the route scope                         |
| `429`  | Rate limit (60 req / 60s per key + IP)                    |

## Rate limit

`X-RateLimit-Limit`, `X-RateLimit-Remaining`, and `X-RateLimit-Reset` are returned on every authenticated response.