# Authenticate a legacy API key
You can authenticate **Redox Data Model API** requests with legacy API keys.
> **Preferred authentication method: OAuth API keys **
>
> We don’t recommend using legacy API keys to authenticate your API requests.
>
> [Check out our authentication overview](/basics/data-exchange-with-redox/authenticating-and-sending-data-via-redox) and [learn how to use OAuth keys](/api-reference/redox-data-model-api/authenticate-an-oauth-api-key) (our preferred authentication method).
## Prerequisites
- A user must be assigned to an **engineer role** to authenticate API keys. [Learn about user roles](/basics/managing-access-for-your-redox-organization/what-are-user-roles).
- Have an existing API source. This is a prerequisite because **sources** and **legacy API keys** are tied 1:1. If you don’t have one yet, [learn how to create an API source](/how-to-use-redox/manage-your-redox-setup/set-up-sources).
- Have a subscription with a **source**, **destination**, and **data model** to send a **Redox Data Model API** request. Talk to your Technical Account Manager if you need a subscription. _For beta users_, [learn how to create a subscription](/how-to-use-redox/manage-your-redox-setup/create-a-subscription).
> **Not supported with the Redox FHIR API**
>
> Legacy API keys aren’t supported with **Redox FHIR API** requests.
## Step 1: Get the legacy API key credentials
1. Log in to the Redox dashboard.
2. From the navigation menu, click the **Developer** page.
3. The Sources tab opens with any configured sources. In the table, find and click the **row** of the API source you want to send the request from.
4. The Details pages opens. Under the Authentication section, copy the **legacy API key ID value**.
5. You have two options to get the secret value:
1. **Use the existing secret value** that you stored securely when you created the source. [Learn how to set up sources](/how-to-use-redox/manage-your-redox-setup/set-up-sources).
2. **Generate a new secret value**.
1. If you didn't generate or store the secret value when you created the source, click the **Edit** button under the Authentication section.
2. Click the **Reset secret** button.
3. A confirmation modal appears. Click the **Reset** button.
4. Copy the **new secret value** and store it securely.
5. Click the **Save** button.
*Generate a new secret value*
> **If legacy API key credentials are exposed**
>
> If either your API key token or secret value are exposed, you must generate a new secret value again.
## Step 2: Send an authentication request
1. Send an authentication request:
**Example: Request for generating an access token**
```bash
curl -X POST https://api.redoxengine.com/auth/authenticate \
-H 'Content-Type: application/json' \
-d '{"apiKey": "{{api-token}}", "secret": "super-secret-client-secret"}'
```
2. You receive the following response:
**Example: Response for generating an access token**
```json
{
"accessToken": "13d5faa8-aacd-4a0d-a666-51455b1b2ced",
"expires": "2015-03-25T20:52:35.000Z",
"refreshToken": "4ed7b234-9bde-4a9c-9c86-e1bc6e535321"
}
```
3. Use the following values from the authentication response:
1. `accessToken`: Use this value in the authorization header to initiate an API request.
2. `expires`: Contains the exact date and time that your access token expires. Access tokens expire 24 hours after retrieval.
> **401 error code**
>
> If you attempt to use an expired access token with a request, you’ll receive a `401 Unauthorized` error.
3. `refreshToken`: Use this value to retrieve a new access token after the initial one expires. See the details for refreshing your token at the end of this article.
## Step 3: Initiate an API request
After successfully authenticating, you can initiate API requests from your API source to the verified destination(s) in your subscription.
### Authorization headers
The Data Model API relies on OAuth 2.0 Bearer to authenticate requests. All API requests must contain an `Authorization` header with a valid access token in the following format: `Authorization: Bearer [your-accessToken].`
**Example: Authorization header for a request**
```bash
curl -X POST https://api.redoxengine.com/endpoint \
-H "Authorization": "Bearer f81eeac9-7cb0-4a82-951b-724f592723ae"
```
| **Header** | **Value** | **Description** |
| --- | --- | --- |
| `Authentication` | `` Bearer `your-authToken` `` | The token that authenticates your request. This header is required. |
| `Content-Type` | `application/json` | The value that identifies the type of API call. |
### Request parameters
Every Data Model API request must contain these body parameters.
| **Parameter** | **Type** | **Description** |
| --- | --- | --- |
| `Meta.DataModel` | String | The data model corresponding to the type of data you're sending or requesting. |
| `Meta.EventType` | String | The event type of the data model that you're sending or requesting. [Learn more about event types](/api-reference/redox-data-model-api/event-types-for-data-models). |
| `Meta.Source.ID` | String | The identifier for the source sending the outgoing request. This parameter is required if you have more than one legacy API key. [Learn more about identifying a source](/basics/data-exchange-with-redox/Managing-source-details-in-outgoing-requests). |
| `Meta.Destinations[].ID` | String array | Objects with ID value(s) of the endpoint(s) you're sending data to or the endpoint you're requesting data from. |
A request should generally look like this:
**Example: General request**
```bash
curl \
-X POST https://api.redoxengine.com/endpoint \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $API_TOKEN" \
-d '{
"Meta": {
"DataModel": "PatientAdmin",
"EventType": "Arrival",
"Destinations": [
{
"ID": "af394f14-b34a-464f-8d24-895f370af4c9",
"Name": "Redox EMR"
}
]
},
"Patient": {
# … payload omitted
}
}'
```
> **Other required parameters**
>
> Each data model has different requirements for parameters. [Explore each data model ](https://docs.redoxengine.com/permalink/data-model-landing-page)to see their respective requirements.
### Sending test API requests
For test requests, send to `https://api.redoxengine.com/endpoint`. [Learn how to send test messages](/quickstart-for-redox/send-test-messages-via-redox).
> **Multi-region users**
>
> If you’re operating in Canada, you have to add the `ca` region to the Redox endpoint URL: `https://api.ca.redoxengine.com`.
## (Optional) Refresh your access token
You can use the refresh token returned from the most recent authentication request to retrieve a new access token via the refresh token endpoint:
**Example: Request for refreshing an access token**
```bash
curl -X POST https://api.redoxengine.com/auth/refreshToken \
-H '{"Content-Type": "application/json"}' \
-d '{"apiKey": "{{API-token}}", "refreshToken": "4ed7b234-9bde-4a9c-9c86-e1bc6e535321"}'
```
The object returned for a successful response is the same as that for the original access token retrieval request noted above.
> **Refresh token expiration**
>
> Refresh tokens are dynamic, so they change and rotate daily. They expire after 7 days of inactivity.
>
> However, we recommend requesting new access tokens rather than managing refresh tokens. This simplifies your workflow and avoids the risk of accidentally leaking a secret value.