> ## Documentation Index
> Fetch the complete documentation index at: https://docs.craftflow.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate with the Craft API using API keys.

## API Keys

All API requests require authentication via an API key. Include your key in the `Authorization` header as a Bearer token:

```bash theme={null}
curl https://data.craftflow.co/api/v1/users/ \
  -H "Authorization: Bearer cf_live_your_api_key_here"
```

***

## Getting Your API Key

You can generate API keys directly from the Craft web app:

<Steps>
  <Step title="Go to Company Settings">
    Log in at [app.craftflow.co](https://app.craftflow.co) and navigate to **Company Settings** from the sidebar.
  </Step>

  <Step title="Open the API Keys tab">
    Click the **API Keys** tab.
  </Step>

  <Step title="Create a new key">
    Click **Create API Key**, give it a descriptive name (e.g., "Production Integration"), and optionally set an expiration date. Click **Create key**.
  </Step>

  <Step title="Copy your key">
    Your API key will be displayed **once**. Copy it immediately and store it somewhere secure — you will not be able to see it again.
  </Step>
</Steps>

### Who can manage API keys?

Only users with **Full Admin** or **Super Admin** permissions can create, rename, and revoke API keys. If you don't see the API Keys tab, ask an admin on your team to generate one for you.

### Key details

* API keys are **scoped to your company**. All requests made with a key will only return data belonging to your company.
* You can revoke a key at any time from the API Keys tab. Revoked keys stop working immediately.
* Optionally set an **expiration date** when creating a key. Keys with no expiration date remain valid until manually revoked.

<Note>
  API keys are prefixed with `cf_live_` so they're easy to identify. Never commit them to source control or share them publicly.
</Note>

***

## Error Responses

| Status Code             | Description                                          |
| ----------------------- | ---------------------------------------------------- |
| `401 Unauthorized`      | Missing or invalid API key.                          |
| `403 Forbidden`         | The API key doesn't have permission for this action. |
| `429 Too Many Requests` | Rate limit exceeded. Wait and retry.                 |

### Example: Invalid API key

```json theme={null}
{
  "error": {
    "detail": "Invalid API key."
  }
}
```

### Example: Expired API key

```json theme={null}
{
  "error": {
    "detail": "API key has expired."
  }
}
```