# Authentication

Data Hub uses API key authentication. Send the API key in the `x-api-key` header.

```http
x-api-key: <api-key>
```

EGYM provisions the API key for your gym location. Export endpoints use the gym location associated with the API key, so clients do not send a gym ID in the path or query parameters.

## Location scope

The API key identifies the partner and gym location for the export request. The API uses the authenticated API key to resolve:

- partner identity
- gym location name
- gym legacy ID
- permissions granted to the API key


Responses only contain data for the gym location associated with the API key.

## Error responses

| Status | Reason |
|  --- | --- |
| `401 Unauthorized` | The `x-api-key` header is missing, malformed, or invalid. |
| `403 Forbidden` | The API key is valid but is not authorized to access this resource. |


## Example request

```bash
curl --request GET \
  'https://analytics.api.egym.com/api/v1/data/smart-strength-workouts?startDate=2026-06-01&endDate=2026-06-15' \
  --header 'x-api-key: <api-key>'
```

All requests must use HTTPS. Calls made over plain HTTP will fail.