# Authentication

Every call carries an Authorization header with your API key.

Every call carries an `Authorization` header with your key.

```text
Authorization: Bearer ptr_live_a1b2c3d4_1a2b3c4d5e6f7g8h9i0j1a2b3c4d5e6f
```

## Getting a key

In the app, under **Settings → API & MCP**. Only the workspace owner or an admin can create one.

> The secret is shown once, at the moment you create it. After that we keep only a hash, and no screen or support person can recover a lost key. If you lose it, revoke the old one and create another.

## What a key can reach

A key belongs to one workspace and sees everything that workspace has, with the same permissions as the person who created it. There is no finer scope yet, such as a read-only key.

Creating, listing and revoking keys happens only in the app, never through the API itself. A key that could mint keys would survive its own revocation, which is the one thing a leaked credential must not do.

## When authentication fails

| Situation | Status | code |
| --- | --- | --- |
| No header at all | `401` | `unauthenticated` |
| Key is malformed, unknown or revoked | `401` | `unauthenticated` |
| Key is valid but the plan does not include the API | `403` | `forbidden` |

A call with no key:

```json
{ "error": { "code": "unauthenticated", "message": "missing Authorization: Bearer <key>" } }
```