---
title: Authentication
description: API key format, the Authorization header, and key management.
order: 2
---

Every `/v1/*` request needs a bearer API key:

```
Authorization: Bearer dike_live_xxxxxxxx
```

Keys are compared in constant time server-side and are never logged above `DEBUG`. There's no separate "test mode" key prefix — every key is live.

## Getting a key

Keys are created and revoked from the [dashboard](/dashboard)'s API Credentials section. Your first key is generated automatically the first time you reach that step. You can hold multiple keys on one account (e.g. one per environment) and revoke any of them independently — revoking a key takes effect immediately.

## Session tokens are different

`/account/*` endpoints (login, signup, key management itself) use a separate JWT session token from `POST /account/login`, not an API key. Don't send your API key to `/account/*` routes or your session token to `/v1/*` routes — they're not interchangeable.

## Scoping

Keys are account-scoped, not per-jurisdiction or per-endpoint. A key that can call `/v1/search` can call every other `/v1/*` endpoint the account's plan allows — see [Rate limits & errors](/docs/getting-started/rate-limits-errors) for what the Free plan excludes.