> ## Documentation Index
> Fetch the complete documentation index at: https://docs.symmetry.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication model

> How CBS authenticates: one API key used by both the widget and the API, and how it compares to Symmetry's other products.

CBS authenticates every request with a single **API key** tied to your account. There's no OAuth flow and no token exchange.

## One key, used two ways

The widget key and the API key are the **same credential**:

* **Widget**: pass the key in the script `src`: `…/salary.js?key=yourKey`. The widget reads it and forwards it to the API.
* **API**: send that same value in the `pcc-api-key` request header.

```text theme={null}
pcc-api-key: yourKey
```

<Note>
  A widget key is visible in page source by nature of client-side embedding. Keep API keys server-side and never commit them to source control.
</Note>

## How this compares to other Symmetry products

CBS uses a plain API key, not a JWT. Symmetry's products don't all authenticate the same way, so if you've integrated another one, note the difference:

| Product                 | Authentication                                  |
| ----------------------- | ----------------------------------------------- |
| Calculators by Symmetry | API key (`pcc-api-key` header)                  |
| Symmetry Payroll Forms  | JWT bearer token                                |
| Symmetry Payroll Point  | JWT bearer token                                |
| Symmetry Tax Engine     | API key (`Authorization` header; no bearer/JWT) |

## Key validation and restrictions

The API validates your key on every request and enforces:

* **Validity**: missing, invalid, or disabled keys are rejected with HTTP 401.
* **Product access**: the key must be entitled to CBS.
* **Domain restriction (optional)**: a key can be limited to specific allowed origins; requests from other domains are rejected.
* **Expiration**: keys carry an expiration date, surfaced in the `X-Pcc-Api-Exp-Date` response header.

Usage caps are covered separately in [Rate limits](/cbs/api/rate-limits).

## Getting a key

To request a key or get help with an existing one, contact your Symmetry Client Success representative or reach out through the [Client Support Center](https://support.symmetry.com). See [Prerequisites](/cbs/getting-started/prerequisites) for details.