> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tailoredd.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Learn how to authenticate ReviewFlow API requests using merchant ID headers, API keys, admin tokens, and browser Origin validation.

## Headers

Every request requires `X-Merchant-Id`. The second auth header depends on the call context:

| Header                | Required for           | Notes                                |
| --------------------- | ---------------------- | ------------------------------------ |
| `X-Merchant-Id`       | All requests           | Your merchant identifier.            |
| `Origin`              | Browser / widget calls | Must match a whitelisted domain.     |
| `X-API-Key`           | Server-to-server calls | Replaces `Origin`. Prefix: `tr_`.    |
| `Authorization`       | Admin endpoints        | Format: `Bearer <admin auth token>`. |
| `X-Webhook-Signature` | Order Complete webhook | HMAC-SHA256 of raw request body.     |

<Warning>
  Keep `X-API-Key` server-side only. It grants full write access. Use `Origin` validation for browser embeds — never expose the key in client-side code.
</Warning>

## Server-to-server example

```javascript theme={null}
const baseUrl = process.env.RF_BASE_URL || 'https://cdn.tailoredd.com/apiV2';
const headers = {
  'X-Merchant-Id': process.env.RF_MERCHANT_ID,
  'X-API-Key':     process.env.RF_API_KEY,
  'Content-Type':  'application/json',
};

const res = await fetch(`${baseUrl}/products/${productId}/reviews`, {
  headers
});
const { data } = await res.json();
```

## Browser / widget example

```javascript theme={null}
const res = await fetch(`${BASE_URL}/products/${productId}/reviews`, {
  headers: {
    'X-Merchant-Id': MERCHANT_ID,
    'Origin': location.origin,
  }
});
```

## Admin endpoints

Admin endpoints require an additional `Authorization` header with your admin auth token:

```text theme={null}
Authorization: Bearer <admin auth token>
```

Contact [contact@tailoredd.com](mailto:contact@tailoredd.com) for admin token provisioning.