# Authentication

LiveID+ uses multiple authentication mechanisms depending on the type of integration and the role of the caller. It is recommended to always pass authentication credentials as **HTTP headers** rather than query parameters or request body fields.

br
## API Key Authentication

For server-to-server API calls, LiveID+ uses API key authentication. The API key is provided by Namirial during platform setup.

The API key should be passed as an HTTP header:


```
apikey: your-api-key-here
```

**Example:**


```
GET /api/authenticate/genAPIToken?idConference=abc123
apikey: your-api-key-here
```

API key authentication is required for the following endpoints:

- `GET /api/authenticate/genAPIToken`
- `PATCH /api/v2/rejectCall`
- `GET /api/v2/getAsyncRequestInfo`
- `POST /api/v2/registerAlertEmail`


br
## JWT Bearer Token

For call-specific operations (e.g., retrieving conference data or audit data), a JWT bearer token is used. This token is scoped to a specific call and has a limited validity.

### Obtaining a Token

Tokens can be obtained in two ways:

1. **From the call closing event**: The `message.token` parameter in the `close` event payload contains a valid JWT.
2. **Via API**: Call `GET /api/authenticate/genAPIToken` with the conference ID (requires API key authentication).


### Using the Token

Pass the token in the `Authorization` header:


```
Authorization: Bearer <jwt_token>
```

JWT bearer tokens are required for:

- `GET /api/v1/conferenceData`
- `DELETE /api/v1/deleteAuditData`
- `GET /api/v2/getAuditData`


br
## Callback Alert Email Registration

Register an email address to receive notifications when server-side callbacks fail.

**Endpoint:** `POST /api/v2/registerAlertEmail`

**Authentication:** API Key (header `apikey`)

**Request Body:**


```json
{
  "processId": "process-uuid",
  "email": "alerts@your-system.com"
}
```

Multiple email addresses can be registered by separating them with commas. Each registration overrides the previous email address for the given process. Sending an empty `email` value removes the current registration.