# Authentication

> Bearer API keys, key management, and org/project scoping.

Source: https://kiln.bricksum.com/docs/en/authentication

All requests are authenticated with an API key passed in the `Authorization` header as a Bearer token. Keys start with sk-bk- and belong to an organization. The x-api-key header is also accepted, but it is read only when the request has no Authorization header. An Authorization header that is not a Bearer token is rejected with 401, with no fallback to x-api-key.

**header**
```http
Authorization: Bearer sk-bk-...
```

Warning

Your API key is a secret. Anyone with it can spend your credits. Never commit it, embed it in front-end code, or share it. Store it in an environment variable and revoke it immediately if it leaks.

## Managing keys

Create, name, and revoke keys in the [console → API keys](https://kiln.bricksum.com/app/keys). The full secret is shown only once at creation; afterwards only a masked value is displayed.

- Create a separate key per application or environment (prod, staging, local).
- Revoke a key as soon as it may have leaked. Revocation is immediate.
- Rotate keys periodically; there is no limit on how many you can hold.

## Organizations and projects

Each key is scoped to an organization and a project. Usage and credit consumption are attributed to that organization, so billing and rate limits apply per organization. Switch the active organization in the console to manage its keys and credits. Roles, invites, projects, key limits, budgets and credits are covered on [Organizations & budgets](https://kiln.bricksum.com/docs/en/organizations).

If a request is rejected, see [Errors](https://kiln.bricksum.com/docs/en/errors) for the 401/403 status codes and their meaning.