# Authentication

Trainer and search endpoints require a **JWT Bearer token** for a company user (an end-user of your app):

```
Authorization: Bearer <jwt_token>
```

**Obtaining a JWT token** — call the verify-api-key endpoint **from your backend** (never embed your company API key in client code):

```
POST https://data.kinestex.com/api/companies/me/verify-api-key/
```

| Header / Field | Required | Description |
|----------------|----------|-------------|
| `x-api-key` header | Yes | Your company's API key |
| `user_id` (JSON body) | Yes | A unique identifier for the end-user in your system (e.g. UUID or database ID) |

```bash
curl -X POST "https://data.kinestex.com/api/companies/me/verify-api-key/" \
  -H "x-api-key: your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{"user_id": "user-abc-123"}'
```

The response includes a `token` field — use it as the Bearer token in all subsequent API requests. The `user_id` you provide should match the `user_id` used across other KinesteX endpoints and SDK launches so user data stays consistent.

**Session tokens (recommended for client launches):** instead of shipping a raw API key to the client, your backend can mint a short-lived session for SDK launches — see [Session Auth & Managed Subscriptions](/docs/trainer-api/trainer-api-subscriptions).

**Language:** the trainer replies in the user's language. Set either header on any trainer request (defaults to English):

```
Language: es              # custom header, takes precedence
Accept-Language: es-MX    # standard header, used as fallback
```

Locale tags are normalized to their base code (`es-MX` → `es`).

---
Source: https://www.kinestex.com/docs/trainer-api/trainer-api-auth · Index: https://www.kinestex.com/llms.txt