> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.rushorder.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.rushorder.com/_mcp/server.

# Authentication

All endpoints use **HTTP Basic authentication** over HTTPS.

Credentials are issued per integration. Contact your Rush Order representative to
request a set for your organization.

## Sending credentials

Supply the username and password as a standard `Authorization: Basic` header. Most HTTP
clients build this for you:

**`curl`**

```bash title="curl"
curl https://dream.rushorder.com/api/stock \
  --user "$RO_API_USER:$RO_API_PASSWORD"
```

**`Python`**

```python title="Python"
import os
import requests

response = requests.get(
    'https://dream.rushorder.com/api/stock',
    auth=(os.environ['RO_API_USER'], os.environ['RO_API_PASSWORD']),
)
response.raise_for_status()
```

**`C#`**

```csharp title="C#"
var credentials = Convert.ToBase64String(
    Encoding.ASCII.GetBytes($"{user}:{password}"));

client.DefaultRequestHeaders.Authorization =
    new AuthenticationHeaderValue("Basic", credentials);
```

## Handling credentials

> **Keep credentials out of source control**
>
> Read them from environment variables or a secrets manager at runtime. Do not commit
> them, and do not place them in query strings, where they may be captured in server
> and proxy logs.

Requests without valid credentials are rejected. Rotate credentials by requesting a new
set before retiring the old one, so your integration is never without working access.