# Authentication

> How Voxmith authenticates ingestion, dashboard, and API requests

Voxmith uses different authentication models for ingestion and dashboard/API access.

## SDK ingestion

SDK ingestion endpoints under `/api/v1/*` use your organization ID in the
`x-org-id` header. SDK configuration and environment variables may format it as
`org_id`, `orgId`, or `VOXMITH_ORG_ID`; all refer to the same organization ID.

The org ID is a public routing identifier. It does not grant dashboard read access by itself.

## Dashboard and API access

Dashboard API endpoints use one of these:

| Method | Headers | Use case |
| - | - | - |
| JWT | `Authorization: Bearer <jwt>` and `x-org-id` | Browser/dashboard access after login |
| API key | `x-api-key` and optional `x-org-id` | Programmatic dashboard/API access |

API keys use the `voxmith_<64-hex>` format and are issued from **Settings -> API Keys**.

## Common mistakes

* Sending `x-org-id` without a JWT or API key to dashboard endpoints.
* Using the wrong org ID when a user belongs to multiple organizations.
* Forgetting the `X-Voxmith-Org-ID` header on OpenTelemetry exporters.
* Treating the org ID as a secret. Rotate API keys if they leak; org IDs are routing identifiers.

## Related pages

* [Quickstart](/quickstart)
* [Capture Session](/capture-session)
* [Capture Event](/capture-event)

## Next steps

* [Packages and versions](/sdks): choose the package that matches your application.
* [Capture a session](/capture-session): create a conversation boundary through the API.
* [Capture an event](/capture-event): send activity into an existing session.