# Authentication Every request carries an API key in the `Authorization` header, in this form: ```text Authorization: silktide token=YOUR_API_KEY ``` There is nothing else to set up: no OAuth flow, no token exchange and no expiry. A key works until someone deletes it. If something between you and Silktide already uses `Authorization`, such as a proxy that signs requests with its own credentials, send the same value in `Silktide-Authorization` instead. When both are present, Silktide reads `Silktide-Authorization`. ```text Silktide-Authorization: silktide token=YOUR_API_KEY ``` Always send the key in a header. Never put it in the address, where it ends up in logs and browser history. ## Keys belong to one account and one region A key is created inside one Silktide account, and it can only reach that account. It also works only on its account's regional host: a European key sent to `api.us.silktide.com` gets `401`, exactly as if it were wrong. See [Find your region](https://developers.silktide.com/guides/quickstart.md#find-your-region). ## What a key can do A key can read and change the account the way an administrator can. An operation that needs a permission says so under **Access** on its page, and returns `403` with the type `AccessDenied` when the key does not have it. ## Keep keys secret - Keep keys on your servers. Never put one in JavaScript that runs in a visitor's browser, in a mobile app, or in a public repository. - Use one key per script or service, named for it, so you can delete one without breaking the others. - Delete a key the moment you think it has leaked, in **Settings**, then **API**. Anything using it stops at once. ## Replace a key Keys never expire, so replace them on your own schedule, or when someone who knew one leaves: 1. Create a new key in **Settings**, then **API**. 2. Put it wherever the old key is used, and check those requests succeed. 3. Delete the old key. Both keys work in between, so nothing has to stop while you switch. ## When a key is refused A refused key gets `401` with this body: ```json { "error": { "type": "NotLoggedIn", "message": "Not logged in", "properties": [] } } ``` Check, in order: 1. The header is spelled `silktide token=`, with the space and the equals sign. 2. You are calling your account's region. 3. The key has not been deleted.