# Authentication for resellers

Reseller integrations use [HTTP Basic Authentication](/authentication). Pass the relevant API key as the username and any value as the password.

## Partner and sub-account API keys

A reseller integration uses two types of API key:

* A **partner API key** authenticates requests to partner-level endpoints used to create and manage sub-accounts.
* A **sub-account API key** authenticates requests made on behalf of a specific sub-account.


Use the partner API key only for partner-level operations. For actions within a sub-account—such as updating its branding or sending an envelope—use that sub-account’s API key.

## Create and retrieve API keys

**Partner API keys** are created and managed in the Signable [web app](https://signable.app/login). Log in and follow the [steps to create an API key](/authentication#create-an-api-key).

A **sub-account API key** is generated when a sub-account is created and included in the [`POST /companies`](/openapi/partners/createcompany) response. Store the key securely when you receive it.

If you need to retrieve the key later, send [`GET /companies/{company_id}`](/openapi/partners/getcompany) using your partner API key.

## Make requests on behalf of a sub-account

Send the required request using the relevant sub-account API key. For example, use the key when sending [`POST /envelopes`](/openapi/envelopes/sendenvelope) to send an envelope for that sub-account.

Store partner and sub-account API keys securely. Do not expose them in client-side code, include them in logs, or commit them to source control. For more information, see [Protect your API keys](/authentication#protect-your-api-keys).