# Authentication
Source: https://docs.tensormachine.ai/authentication

## API keys

All API requests are authenticated using **Bearer tokens** passed in the `Authorization` header:

```
Authorization: Bearer tx_live_xxxxxxxxxxxxxxxxxxxxxxxx
```

API keys are scoped to your account and carry your billing identity. Treat them like passwords — never commit them to source control.

## Key prefixes

| Prefix | Environment | Billing |
|--------|-------------|---------|
| `tx_live_` | Production | Yes — tokens are charged |
| `tx_test_` | Sandbox | No — free, capped at 10K tokens/day |

Use test keys during development and integration testing. Switch to a live key only in production.

## Creating keys

1. Open **Dashboard → Settings → API Keys**
2. Click **Create new key**
3. Name it (e.g., `backend-prod`, `mobile-staging`)
4. Copy the key immediately — it is hashed before storage and cannot be retrieved again

## Security best practices

- **Never hardcode keys** in source files or Docker images — use environment variables or a secrets manager
- **Use one key per application** so you can revoke individual keys without affecting other services
- **Rotate keys every 90 days** — create a new key, deploy it, then revoke the old one
- **Monitor usage** — the dashboard shows per-key token consumption; anomalies may indicate a leaked key
- **Set IP allowlists** (Pro plan and above) — restrict which IP addresses can use a key

## Revoking keys

Keys can be revoked instantly from **Dashboard → Settings → API Keys**. Revoked keys are rejected within seconds across all regions.

## Error responses

If authentication fails, the API returns:

```json
{
  "error": {
    "message": "Invalid API key provided.",
    "type": "authentication_error",
    "code": "invalid_api_key"
  }
}
```

HTTP status: `401 Unauthorized`