> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zeal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and Keys

> Learn how to obtain your Zeal API keys, pass them as Bearer tokens, manage test vs. production keys, and keep your credentials secure.

Every request to the Zeal REST API must be authenticated with an API key issued to your partner account. Zeal uses standard HTTP Bearer token authentication - you include your key in the `Authorization` header of every request. There are no session tokens or cookie-based flows; each request is independently authenticated.

## Obtaining your API keys

Your API keys live on the **API** page of the Partner Dashboard at [app.zeal.com](https://app.zeal.com). You will find both a **Test API key** and a **Production API key** there, along with your **`partnerID`**.

If you are logging in for the first time, click **Forgot Password** on the login screen to set your password. Once inside the dashboard, navigate to the **API** page and copy the key appropriate for your environment.

## Passing the API key

Include the key in the `Authorization` header of every HTTP request:

```
Authorization: Bearer {apiKey}
```

Replace `{apiKey}` with your actual key. The header must appear on every request - there is no session-level authentication.

### Example request

```bash theme={null}
curl --request GET \
     --url 'https://api.zeal.com/companies?partnerID=YOUR_PARTNER_ID' \
     --header 'Accept: application/json' \
     --header 'Content-Type: application/json' \
     --header 'Authorization: Bearer YOUR_API_KEY'
```

## Test vs. production keys

Zeal maintains two fully isolated environments. Each has its own API key.

| Key type               | Environment    | Effect                                                                                     |
| ---------------------- | -------------- | ------------------------------------------------------------------------------------------ |
| **Test API key**       | Test (sandbox) | Payroll is processed end-to-end but **no money is moved** and no real tax filings are made |
| **Production API key** | Production     | Payroll runs for real - money is disbursed, taxes are filed                                |

<Note>
  Use your **Test API key** for all development and integration work. Resources created with the Test key (companies, workers, checks) are completely isolated from Production and will not appear in the live environment.
</Note>

## The partnerID header

Some endpoints require a `partnerID` in addition to your API key. The `partnerID` identifies your Zeal partner account and is found on the same **API** page as your keys. It is typically passed as a request body parameter (for `POST`/`PATCH` requests) or as a query parameter (for `GET` requests) rather than as a header.

## Rolling a compromised key

If you believe a key has been exposed, rotate it immediately from the **API** page of the Partner Dashboard. Click the **refresh icon** next to the compromised key and follow the on-screen prompts. The old key is invalidated instantly and a new key is issued. Update any systems that relied on the old key before the rotation.

<Warning>
  Never commit API keys to version control, include them in client-side code, or log them to any output stream. Treat them with the same care you would a password. Grant access only to team members and services that genuinely need it.
</Warning>

## Webhook authentication

When Zeal sends webhook payloads to your configured endpoints, it includes a `Puzzl-Signature` header containing a shared secret. You can find this secret under the **Webhook secrets** tab on the **API** page. Configure your webhook handlers to reject any request that does not include a valid `Puzzl-Signature` header to prevent spoofed events.