# Authentication

Privy issues each merchant one API key for each environment. Send the key in
the `X-API-Key` header for these back-channel operations:

- Create a verification session.
- Exchange a result code for a verified-data JWT.

```http
X-API-Key: <MERCHANT_API_KEY>
```

> Keep the API key on the merchant backend. Do not put the API key in a
> browser, iframe, WebView, or mobile application.

The JWKS and health endpoints are public. They do not use the API key.

API keys are specific to the sandbox or production environment. See
[Environments](/digital-id/concepts/environments).

The merchant credentials are the API key and, with the Identity package, the
RSA private key. See
[Encrypted Identity Data](/digital-id/guides/encrypted-identity-data).