> ## Documentation Index
> Fetch the complete documentation index at: https://omniloy.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and security

> API Key for API authentication and HMAC-SHA256 signatures for webhook verification

## API authentication (API Key)

All operations use an **API Key** in the `X-Api-Key` header:

```
X-Api-Key: <your-api-key>
```

The same API key is used for both inbound and outbound calls. For outbound calls, `questionnaireId` is sent in the body of `POST /api/v1/calls/external-questionnaire`.

## HMAC signatures on webhooks

Webhooks (both **MarIA→Client** and **EHR/HIS**) are signed with `HMAC‑SHA256` over the **RAW body**. Integrators can validate the header for additional security:

```
X-Integration-Signature: sha256=<hex>
```

See the [HMAC Signature Verification](/maria/en/webhooks-firmas) guide for implementation details and code examples.