# Connect with an API key or static token

With **API key / static token**, each connection stores a key and the gateway adds it to every call. Use it when your API accepts a long-lived key or token that does not have to be renewed.

## How the gateway sends the key

The API says where the key goes. The connection holds the key itself.

| Setting on the API | What the gateway sends |
| --- | --- |
| **Send as** > **HTTP header** | The header named in **Header name**, with the **Prefix** before the key. With the defaults, `Authorization: Bearer <key>`. |
| **Send as** > **Query parameter** | The key appended to every URL as `?<name>=<key>`, where the name is **Parameter name**. |
| **Send as** > **gRPC metadata** | A metadata entry named in **Metadata key**. A gRPC API always sends the key this way. |

The key is stored encrypted. Agents never see it.

## Set the strategy on the API

To set where the key goes:

1. In the portal, go to [**APIs**](https://auth.faustine.ai/go?to=%2Fintegrations%2Fapis) and select your API.
2. Select the **Authentication** tab, then **Edit**.
3. In **Sign-in method**, select **API key / static token**.
4. In **Send as**, select **HTTP header** or **Query parameter**.
5. Enter the **Header name** or **Parameter name** your API reads, such as `X-API-Key`.
6. In **Prefix**, enter what goes before the key, such as `Bearer ` with its trailing space. Leave it empty to send the key as is.
7. Select **Save changes**.

## Add the key to a connection

To store the key for one deployment, [add a connection](https://docs.faustine.ai/apis/add-a-connection/) and paste the key in **Key** in the **Credentials** step.

The **Test** step shows **Reached the endpoint** and the HTTP status of the call. A `401` or `403` there means your API refused the key or did not find it where the gateway sends it.

## Troubleshooting

| Symptom | Cause | Fix |
| --- | --- | --- |
| `The header or parameter name is required.` | **Header name** or **Parameter name** is empty. | Enter the name your API reads the key from. |
| The test answers `401` with a correct key | Your API expects a different header, or no `Bearer ` prefix. | Change **Header name** and **Prefix** in the **Authentication** tab. |
| The connection is marked **needs credentials** | The connection has no key. | Open the connection and enter **Key**. |

## Next steps

- [Authentication](https://docs.faustine.ai/apis/authentication/): the other strategies.
- [Add an API to a gateway](https://docs.faustine.ai/agent-gateway/add-an-api/): serve the API through the connection.