> ## Documentation Index
> Fetch the complete documentation index at: https://doc.folkyn.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Team API keys and how to send them on each request

## API keys

Each key belongs to **one team**. Every request is restricted to that team’s data.

Per-route scopes may be enforced in a future release; today any valid key for the team can access all documented `/api/v1` routes.

## Sending the key

Send the full secret in the **`Authorization`** header using the **Bearer** scheme (common pattern for HTTP APIs):

```http theme={null}
Authorization: Bearer fk_live_...
```

If your client or gateway cannot set `Authorization`, the same secret is accepted in **`X-Api-Key`**.

## Key format

Keys start with `fk_live_` followed by a random secret. Store the full value securely (secret manager, environment variables). Never commit keys to source control or expose them in a browser.

## Missing, invalid, or revoked keys

* No key → **401**, message explains missing header.
* Invalid key → **401**.
* Revoked key → **401**.

Use `error.message` to distinguish; `error.request_id` + header `X-Request-Id` for support.