# Quickstart

Follow these three steps to make your first authenticated request against Core Platform.

<Steps>
  <Step title="Install">
    Pick your package manager:

    <Tabs>
      <Tab title="npm">
        ```bash
        npm install @acme/core-sdk
        ```
      </Tab>
      <Tab title="pnpm">
        ```bash
        pnpm add @acme/core-sdk
        ```
      </Tab>
      <Tab title="yarn">
        ```bash
        yarn add @acme/core-sdk
        ```
      </Tab>
    </Tabs>
  </Step>
  <Step title="Configure">
    Set your API key as an environment variable - never hardcode it in source:

    ```bash
    export ACME_API_KEY="sk_live_..."
    ```
  </Step>
  <Step title="Make a request">
    <CodeGroup>
    ```js title="index.js"
    import { Core } from "@acme/core-sdk";

    const client = new Core({ apiKey: process.env.ACME_API_KEY });
    const widgets = await client.widgets.list({ limit: 10 });
    console.log(widgets);
    ```
    ```bash title="cURL"
    curl https://api.kitchen-sink.example.com/v1/widgets \
      -H "X-API-Key: $ACME_API_KEY"
    ```
    </CodeGroup>

    A successful response looks like this:

    ```json
    [
      { "id": "wdg_abc123", "name": "Sprocket", "color": "indigo" },
      { "id": "wdg_def456", "name": "Gizmo", "color": "amber" }
    ]
    ```
  </Step>
</Steps>

> That's it - you've made your first request. From here, [Authentication](/docs/core/2026-01/guides/auth/) covers scopes and token expiry, and the [OpenAPI Demo](/petapi/widgets/get-widgets/) tab has the full generated reference for every endpoint.

## SDKs at a glance

| Language | Package | Minimum version |
|---|---|---|
| JavaScript / TypeScript | `@acme/core-sdk` | Node 18+ |
| Python | `acme-core` | Python 3.9+ |
| Go | `github.com/acme/core-go` | Go 1.21+ |

## Common first steps

- Create an API key in the dashboard under **Settings → API Keys**.
- Restrict the key's scopes to only what your integration needs.
- Set up a webhook endpoint if you need real-time updates instead of polling.
  - Webhooks retry with exponential backoff for up to 24 hours.
  - Each delivery includes an `X-Signature` header - verify it before trusting the payload.
- Read [Rate limits](/docs/core/2026-01/guides/rate-limits/) before writing a tight polling loop.

Or, in order, if you'd rather follow a numbered checklist:

1. Create an account and verify your email.
2. Generate an API key.
3. Install an SDK (or use `curl` directly, as shown above).
4. Make a test request against a sandbox resource.
5. Go live once your integration passes review.

---

Once you're through the checklist above, the rest of these guides go deeper on specific pieces - authentication, limits, and the underlying concepts.