# Authentication

Every request to the Circuitry API, at `https://api.circuitry.company/v1`, sends an API key in the `Authorization` header as a bearer token.

```bash
curl https://api.circuitry.company/v1/app \
  -H "Authorization: Bearer $CIRCUITRY_API_KEY"
```

## API keys

Each key belongs to one app, and every request it makes acts as that app. Create and revoke keys on the app's page in the [dashboard](https://app.circuitry.company/apps).

* Keys start with `ck_live_`.
* The dashboard shows a key once, when you create it. Circuitry stores only a hash of each key, so a lost key can't be recovered. Create a new key and revoke the lost one.
* An app can have up to 20 keys. Then each server or agent can have its own key, and you can rotate the keys one at a time.
* When you revoke a key, its next request fails with `invalid_api_key`.

:::warning
API keys are for servers and agents. Never put one in a browser or mobile app, because anyone who has it can call the API as your app. The API sends no CORS headers, so browsers block requests to it.
:::

## Check a key

[`GET /v1/app`](/reference/app) returns the app a key belongs to. It's a quick way to check that a key works.

## Failed authentication

| Status | Code | Meaning |
| --- | --- | --- |
| 401 | `invalid_api_key` | The key is missing, malformed, unknown, or revoked |
| 403 | `app_paused` | The key's app is paused |
| 429 | `rate_limited` | The key made too many requests. See [Rate limits](/rate-limits) |