# Authentication

The Apaczka API v2 authenticates every request with an **HMAC-SHA256
signature**. There are no tokens or sessions — each call carries your
`app_id` and a signature computed from the request itself using your
`app_secret`.

1. Get your `app_id` and `app_secret` in the
   [Apaczka panel](https://panel.apaczka.pl) under **Settings → API**.
2. Sign every request as described in
   [Request signing (HMAC)](/legacy/hmac-signing).

:::tip

Integrating from PHP? The official [SDK](/sdk) signs every request
automatically — you only pass the credentials to the client and never touch
the signature yourself.

:::

:::caution

Keep the `app_secret` server-side only — never embed it in mobile apps or
frontend code.

:::