> Documentation index: https://beezr.io/developers/api/llms.txt

# Authentication

## Send the key

Every endpoint requires `X-API-Key`. All requests are POST with a JSON body and `Content-Type: application/json`.

```curl
-H "X-API-Key: $BEEZR_API_KEY" \
-H "Content-Type: application/json"
```

Create keys in Designer → Account settings → API Integration. See [Create and manage API keys](https://designer.beezr.io/docs/connect/api-keys/).

## Keep keys server-side

A key acts for the whole workspace, across every module. Keep it on your server. Never put it in a browser or mobile app. Use one key per system so you can pause a system's key without replacing another system's key.

If you suspect a key has leaked, pause it in the Designer. Paused and deleted keys return HTTP 401.

## Recognize an authentication failure

```json
{"success":false,"error":{"code":"AUTHENTICATION_FAILED","message":"Invalid or missing API key"}}
```

HTTP 401 means the key is missing, invalid or paused. Check the environment variable and header before trying again. Changing a filter or module name won't fix authentication.

Workspace limits are shared across keys. Creating another key does not give that workspace another request allowance. See [Limits](/developers/api/limits/).