> ## Documentation Index
> Fetch the complete documentation index at: https://schedy.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Protect every endpoint with an API key using the X-API-Key header.

When `SCHEDY_API_KEY` is set, every request must include the matching key:

```bash theme={null}
curl http://localhost:8080/tasks -H "X-API-Key: your-secret"
```

| Situation           | Response           |
| ------------------- | ------------------ |
| Missing `X-API-Key` | `401 Unauthorized` |
| Wrong key           | `403 Forbidden`    |

If `SCHEDY_API_KEY` is unset, all endpoints are open - fine for local use. Put a reverse proxy in front for anything exposed to the internet.