> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dafty.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate every request with an API key.

All endpoints except `GET /api/v1/openapi.json` require an API key.

## Getting a key

Create and manage keys from your dashboard at `/api-keys`. The plaintext value is shown **once** at
creation - copy it then. You can name, deactivate, and revoke keys later; revocation takes effect
immediately.

## Sending the key

Use either header (pick one):

```bash theme={null}
# Preferred
curl https://app.dafty.ai/api/v1/account -H "x-api-key: $DAFTY_API_KEY"

# Or a bearer token
curl https://app.dafty.ai/api/v1/account -H "Authorization: Bearer $DAFTY_API_KEY"
```

A missing, malformed, revoked, or expired key returns `401`:

```json theme={null}
{ "error": { "code": "UNAUTHORIZED", "message": "Invalid API key" } }
```

## Check what a key can see

* `GET /account` - the account the key belongs to and its plan.

<Note>
  Keys are scoped to your account. Generation consumes credits the same way the in-app product does;
  keep keys secret and rotate them if leaked.
</Note>