> ## Documentation Index
> Fetch the complete documentation index at: https://docs.creatorline.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Organization-scoped API keys: how they work, what they can do, and how to keep them safe.

Every request carries an API key that belongs to **one organization**. There is no
account switching and no workspace parameter — the tenant comes from the credential, so a
key can only ever see and spend its own organization's data and credits.

```bash theme={null}
curl https://api.creatorline.io/v1/me \
  -H "Authorization: Bearer $CREATORLINE_API_KEY"
```

`X-API-Key: crl_sk_live_…` works identically if your tooling prefers it.

## Creating a key

Owners and admins create keys in the studio under **Settings → API**.

<Warning>
  The key is displayed **exactly once**, when you create it. We store only a keyed hash of
  it, so there is no endpoint — and no support request — that can show it to you again.
  Lost a key? Revoke it and create another.
</Warning>

## Anatomy

```
crl_sk_live_a7F3k2p9QxZm_8Kd2mXpLq…4f2c_9xQ2mR
└ prefix ──┘└ key id ────┘└ secret ────┘└ crc ┘
```

<ResponseField name="prefix" type="crl_sk_live_">
  Marks the string as a Creatorline secret key so secret scanners and log scrubbers can
  spot a leak. If one of these ever lands in a public repository, revoke it immediately.
</ResponseField>

<ResponseField name="key id" type="12 chars">
  Public. It is what identifies the key in the dashboard (`crl_sk_live_a7F3k2p9QxZm…4f2c`)
  and in our logs — safe to quote in a support conversation.
</ResponseField>

<ResponseField name="secret" type="32 chars">
  190 bits of randomness, never stored. We keep only a keyed hash.
</ResponseField>

<ResponseField name="crc" type="6 chars">
  A checksum over everything before it. A mistyped or forged key is rejected instantly,
  without a database lookup.
</ResponseField>

## Scopes

<CardGroup cols={2}>
  <Card title="read" icon="eye">
    Every `GET`, plus cost estimates. Cannot spend a single credit. **Use this for CI and
    for anything that only reads.**
  </Card>

  <Card title="write" icon="pen">
    Everything above, plus starting generations, uploading media, and publishing posts.
  </Card>
</CardGroup>

A `read` key that attempts a write gets a `403` naming the problem, not a mysterious
failure:

```json theme={null}
{
  "error": {
    "type": "permission_error",
    "code": "insufficient_scope",
    "message": "This API key is read-only. Create a key with the `write` scope to run generations."
  },
  "request_id": "req_8fQ2mRxK1pLd"
}
```

## Rotation and revocation

Revoking is immediate — the next request with that key gets a `401`. The key's row
survives so your usage history and audit trail keep resolving.

To rotate without downtime: create the new key, deploy it, then revoke the old one. A key
can also be given an expiry at creation, which is the right choice for a short-lived job.

## Rate limits

**120 requests per minute per key.** Every response carries the state of your window:

| Header                  |                             |
| ----------------------- | --------------------------- |
| `x-ratelimit-limit`     | requests allowed per window |
| `x-ratelimit-remaining` | requests left               |
| `x-ratelimit-reset`     | unix seconds when it resets |

On a `429`, honour `Retry-After`. Generation is separately gated by your credit balance,
which is usually the limit you will meet first.

## Keeping keys safe

<Steps>
  <Step title="Server-side only">
    A key can spend your organization's credits and publish to your creators' accounts.
    Never ship one to a browser, a mobile app, or anything a user can read.
  </Step>

  <Step title="Environment, not source">
    `CREATORLINE_API_KEY` in your environment or secret manager. Never in a repository,
    never in a URL query string.
  </Step>

  <Step title="One key per consumer">
    A key per service, per environment, per developer machine. Then revoking one is a
    non-event instead of an outage, and the usage counters tell you who is spending what.
  </Step>
</Steps>


## Related topics

- [Finish an upload](/api-reference/assets/finish-an-upload.md)
- [Start an upload](/api-reference/assets/start-an-upload.md)
- [Publish a post](/api-reference/posts/publish-a-post.md)
- [Who am I](/api-reference/account/who-am-i.md)
- [Create a post](/api-reference/posts/create-a-post.md)