> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ruddr.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate requests to the Ruddr API

The Ruddr API uses API keys to authenticate requests. Each key grants full read and write access to all data within a workspace, so treat them like passwords.

To create an API key, follow the steps in the [Quick Start](/guides/quick-start) guide.

## Using the API Key

Include the API key in the `Authorization` header using the Bearer scheme:

```
Authorization: Bearer <token>
```

## Key Management

* **No expiration**: API keys are valid indefinitely until explicitly revoked.
* **Revocation**: Delete a key from **Settings > API Keys** in your workspace. Revocation takes effect immediately — any request using that key will return `401`.
* **No scopes**: All keys have the same access level. There are no read-only or restricted keys.

## Security Best Practices

* **Store keys securely**: Use environment variables or a secrets manager. Never hard-code keys in source code.
* **Server-side only**: API keys should only be used in server-side code. Never expose them in client-side JavaScript, mobile apps, or public repositories.
* **Rotate periodically**: Create a new key, update your integration, then delete the old one.

## Errors

### 401 Unauthorized

The API key is missing, malformed, or does not match a valid key:

```json theme={null}
{
  "status": 401,
  "message": "The provided bearer token is missing or invalid."
}
```

### 423 Locked

API access has been disabled for the workspace:

```json theme={null}
{
  "status": 423,
  "message": "API access is disabled, please contact support for assistance."
}
```