> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scanoss.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate the SCANOSS Go SDK with an API key and configure a custom API endpoint.

## Default Behaviour

By default, `scanoss.New` connects to `https://api.scanoss.com` (`scanoss.DefaultAPIURL`) without authentication. The public endpoint rejects keyless requests; a custom endpoint, an on-prem deployment for example, may allow them.

## Using an API Key

Pass it as `APIKey` on `Config`. You can obtain an API key from your SCANOSS account dashboard.

```go theme={null}
client, err := scanoss.New(scanoss.Config{
	APIKey: os.Getenv("SCANOSS_API_KEY"),
})
```

## Using a Custom API Endpoint

Set `APIURL` to direct the SDK at a different endpoint, such as an on-prem deployment:

```go theme={null}
client, err := scanoss.New(scanoss.Config{
	APIURL: "https://scanoss.internal.example.com",
})
```

## Proxy and Custom CA

```go theme={null}
client, err := scanoss.New(scanoss.Config{
	APIKey:     key,
	Proxy:      "http://proxy.example.com:8080", // empty honours HTTP(S)_PROXY
	CACertFile: "/etc/ssl/corp-ca.pem",          // added to the system pool
})
if err != nil {
	return err // an unreadable CA file or a schemeless proxy fails here
}
```

| Field         | Behaviour                                                                                                                                                                          |
| ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Proxy`       | Overrides `HTTP_PROXY`/`HTTPS_PROXY` for this client only. Needs an `http://` or `https://` scheme; `NO_PROXY` still applies. Empty leaves Go's own environment handling in place. |
| `CACertFile`  | A PEM file whose certificates are trusted *in addition to* the system pool. Verification stays on, this adds an authority, it doesn't stop checking.                               |
| `InsecureTLS` | Disables certificate verification entirely. For self-signed or internal endpoints only; prefer `CACertFile`, which keeps verification on.                                          |

<Note>
  An unreadable CA file or a schemeless proxy fails at `scanoss.New(...)`,
  not on the first request, so a misconfiguration surfaces immediately
  rather than mid-scan.
</Note>

See [Usage](usage) for the remaining `Config` fields, request timeout, retry behaviour, and decoration chunk/worker tuning.