> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mansa.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Learn how to authenticate with the API using JWT tokens

## Overview

To interact with the API, you will need an API Key and a Private Key, both of which are used to compile a JWT for authentication.

<Note>
  **Please note that all API calls must be authenticated.**
</Note>

Below is a brief overview of the authentication process:

1. Generate a new key pair for Elliptic Curve Digital Signature Algorithm (ECDSA) with NIST curve P-256
2. Generate your API Key and API Secret at the Mansa platform
3. Create JWT tokens for API authentication
4. Make authenticated API calls

## Key Generation

### 1. Generate a New ES256 Key Pair

For macOS and most Linux distributions, OpenSSL is typically pre-installed. Windows users need to install OpenSSL.

We recommend using the version bundled with Git for Windows ([https://gitforwindows.org](https://gitforwindows.org)).

To create your key pair, open the terminal (Git Bash for Windows users), and enter the following command:

```bash theme={null}
openssl ecparam -genkey -name prime256v1 -noout -out myPrivateKeyPair.pem
```

Next, run this command to extract the public key:

```bash theme={null}
openssl ec -in myPrivateKeyPair.pem -pubout -out myPublicKeyPair.pem
```

<Warning>
  Make sure to keep your private key secure and never share it with anyone, including Mansa.
</Warning>

### 2. Generate Your API Keys

To obtain your API keys, please contact your account manager on the Mansa platform. You will need to provide the public key generated in the previous step. Once verified, you will receive three credentials required for authentication:

* API Key
* API Secret
* Audience

## API Call Rate Limit

The API implements request limits to encourage fair distribution of resources and to uphold system stability. Requests are limited to **100 requests per minute** per API key.

Exceeding the limit returns an HTTP `429` response with:

```json theme={null}
{ "error": "Too many requests, please try again later." }
```

If your needs deviate from these constraints, we encourage you to reach out to us. Our team is more than ready to engage in discussions about alternative arrangements that may be more suited to your specific requirements.