> ## Documentation Index
> Fetch the complete documentation index at: https://docs.endprompt.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Manage API keys for calling your endpoints

To call your Endprompt endpoints, you need an API key. This page covers creating, managing, and using API keys securely.

## Creating an API Key

<Steps>
  <Step title="Navigate to API Keys">
    Click **API Keys** in the sidebar.
  </Step>

  <Step title="Click Create API Key">
    Click the **Create API Key** button.
  </Step>

  <Step title="Name Your Key">
    Give it a descriptive name:

    * `Production - Web App`
    * `Development - Local`
    * `CI/CD Pipeline`
  </Step>

  <Step title="Copy the Key">
    Copy the displayed key immediately. You won't see it again!
  </Step>
</Steps>

<Warning>
  API keys are shown only once at creation. Store them securely immediately. If you lose a key, create a new one.
</Warning>

## Using Your API Key

Include your API key in the `x-api-key` header:

<CodeGroup>
  ```bash cURL theme={null}
  curl -X POST https://yourcompany.api.endprompt.ai/api/v1/summarize \
    -H "Content-Type: application/json" \
    -H "x-api-key: ep_live_xxxxxxxxxxxxxxxxxxxx" \
    -d '{"text": "Your content here"}'
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch('https://yourcompany.api.endprompt.ai/api/v1/summarize', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'x-api-key': 'ep_live_xxxxxxxxxxxxxxxxxxxx'
    },
    body: JSON.stringify({ text: 'Your content here' })
  });
  ```

  ```python Python theme={null}
  import requests

  response = requests.post(
      'https://yourcompany.api.endprompt.ai/api/v1/summarize',
      headers={
          'Content-Type': 'application/json',
          'x-api-key': 'ep_live_xxxxxxxxxxxxxxxxxxxx'
      },
      json={'text': 'Your content here'}
  )
  ```
</CodeGroup>

## API Key Format

Endprompt API keys follow a consistent format:

```
ep_live_xxxxxxxxxxxxxxxxxxxx
│  │    └── Random characters
│  └── Environment (live/test)
└── Prefix
```

## Managing API Keys

### Viewing Keys

The API Keys page shows:

| Column        | Description              |
| ------------- | ------------------------ |
| **Name**      | Your descriptive name    |
| **Created**   | When the key was created |
| **Last Used** | Most recent API call     |
| **Status**    | Active or Revoked        |

<Note>
  For security, you cannot view the full key after creation. Only the last 4 characters are shown.
</Note>

### Revoking Keys

If a key is compromised:

1. Go to **API Keys**
2. Find the key to revoke
3. Click **⋯** → **Revoke**
4. Confirm the action

<Warning>
  Revoking a key immediately invalidates it. Any applications using that key will start receiving 401 errors.
</Warning>

### Rotating Keys

Best practice is to rotate keys periodically:

<Steps>
  <Step title="Create New Key">
    Create a new API key with a similar name.
  </Step>

  <Step title="Update Applications">
    Deploy the new key to your applications.
  </Step>

  <Step title="Verify">
    Confirm the new key works correctly.
  </Step>

  <Step title="Revoke Old Key">
    Revoke the previous key.
  </Step>
</Steps>

## Security Best Practices

<CardGroup cols={2}>
  <Card title="Never Expose Keys" icon="eye-slash">
    Don't commit keys to git or expose in client-side code
  </Card>

  <Card title="Use Environment Variables" icon="terminal">
    Store keys in env vars, not hardcoded
  </Card>

  <Card title="Rotate Regularly" icon="arrows-rotate">
    Create new keys and revoke old ones periodically
  </Card>

  <Card title="Use Separate Keys" icon="layer-group">
    Different keys for dev, staging, production
  </Card>
</CardGroup>

### Environment Variables

Store your API key in environment variables:

<CodeGroup>
  ```bash .env theme={null}
  ENDPROMPT_API_KEY=ep_live_xxxxxxxxxxxxxxxxxxxx
  ```

  ```javascript Node.js theme={null}
  const apiKey = process.env.ENDPROMPT_API_KEY;
  ```

  ```python Python theme={null}
  import os
  api_key = os.environ.get('ENDPROMPT_API_KEY')
  ```
</CodeGroup>

### Key Naming Convention

Use descriptive names that identify:

* Environment (Production, Staging, Development)
* Application or service name
* Purpose

Examples:

* `Production - Main API`
* `Staging - Integration Tests`
* `Development - Local Testing`
* `CI/CD - GitHub Actions`

## Authentication Errors

### 401 Unauthorized

```json theme={null}
{
  "error": "unauthorized",
  "message": "Invalid or missing API key"
}
```

**Causes:**

* Missing `x-api-key` header
* Invalid API key
* Revoked API key

**Solutions:**

* Verify the header name is exactly `x-api-key`
* Check for typos in the key
* Confirm the key is active in your dashboard

### 403 Forbidden

```json theme={null}
{
  "error": "forbidden",
  "message": "Access denied to this endpoint"
}
```

**Causes:**

* Key doesn't have access to the endpoint
* Endpoint is internal/private

## Rate Limits Per Key

Each API key has its own rate limits:

| Limit      | Default         |
| ---------- | --------------- |
| Per Minute | 60 requests     |
| Per Hour   | 1,000 requests  |
| Per Day    | 10,000 requests |

<Tip>
  Contact support if you need higher limits for your use case.
</Tip>

## Next Steps

<CardGroup cols={2}>
  <Card title="Making Requests" icon="arrow-right" href="/api/making-requests">
    Learn the request format
  </Card>

  <Card title="Code Examples" icon="code" href="/api/code-examples">
    Complete examples in multiple languages
  </Card>

  <Card title="Admin API Keys" icon="key" href="/admin-api/authentication">
    Create admin keys for management access and MCP
  </Card>

  <Card title="MCP Server" icon="robot" href="/admin-api/mcp-server">
    Connect AI coding tools to Endprompt
  </Card>
</CardGroup>