> ## Documentation Index
> Fetch the complete documentation index at: https://docs.authflame.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate requests to the AuthFlame API

> Use a bearer API key in the Authorization header to authenticate every request to the AuthFlame API, and follow key handling best practices.

AuthFlame authenticates every request with a bearer API key. Pass your key in the `Authorization` header on each call.

## API keys

Keys are issued from your AuthFlame dashboard and look like:

```text theme={null}
af_live_**************************
```

The `af_live_` prefix identifies a live (production) key. API keys currently authorize email checks only, but treat them as secrets: a leaked key lets anyone burn through your check quota or run checks against your account until you rotate it.

## Sending the header

Add an `Authorization` header of the form `Bearer <api_key>` to every request.

<CodeGroup>
  ```bash curl theme={null}
  curl -X POST https://api.authflame.com/v1/ \
    -H "Authorization: Bearer af_live_your_api_key" \
    -H "Content-Type: application/json" \
    -d '{"email": "test@example.com"}'
  ```

  ```powershell PowerShell theme={null}
  $headers = @{
    "Authorization" = "Bearer af_live_your_api_key"
    "Content-Type"  = "application/json"
  }
  $body = @{ email = "test@example.com" } | ConvertTo-Json

  Invoke-RestMethod `
    -Uri "https://api.authflame.com/v1/" `
    -Method Post `
    -Headers $headers `
    -Body $body
  ```

  ```javascript Node.js theme={null}
  await fetch("https://api.authflame.com/v1/", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.AUTHFLAME_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ email: "test@example.com" }),
  });
  ```
</CodeGroup>

## Best practices

<Warning>
  API keys authorize email checks from your account. A leaked key can be used to exhaust your quota or run unwanted checks, so never embed keys in browser code, mobile apps, or public repositories.
</Warning>

* Store keys in environment variables or a secret manager, not in source control.
* Call AuthFlame only from your backend. Public clients should never see the key.
* Rotate keys if you suspect exposure. Old keys can be revoked from the dashboard.
* Use separate keys per environment (development, staging, production) so you can revoke one without affecting the others.

## Authentication errors

Requests with a missing, malformed, or revoked key return `401 Unauthorized`. See [Errors](/api-reference/errors) for the response shape.