# Authentication

> **Section:** [Introduction](https://docs.editsquare.com/api.md)
> **Related:** [Errors](https://docs.editsquare.com/api/errors.md) · [Pagination](https://docs.editsquare.com/api/pagination.md) · [Renders](https://docs.editsquare.com/api/renders.md) · [Webhooks](https://docs.editsquare.com/api/webhooks.md)
> **Also:** [HTML version](https://docs.editsquare.com/api/authentication) · [Docs index](https://docs.editsquare.com/llms.txt)

---

All Edit Square endpoints are authenticated using API keys as a bearer token:

<RequestSample {...listRendersSample} />

Full request and response documentation can be found in the [renders api reference](/api/reference/operations/tags/renders/) section.

Any request with no `Authorization` header will be rejected with `401`.

## Getting a key

Keys are created in the dashboard:

1. Open the dashboard and click your avatar in the bottom-left.
2. Choose **API Keys**.
3. **Create** a key and give it a name you will recognise later.

:::tip{icon="information"}
The key is only ever shown **once** at creation, make sure you take a copy of it. If you have lost you key it must be replaced and the previous key revoked.
:::

Keys look like `sk_` followed by 32 characters. The dashboard shows a
masked form (`sk_1a2b3…cdef`), which is enough to tell two keys
apart and not enough to use one.

## What a key can reach

A key belongs to the person who created it and carries that person's access: it
reaches the projects their teams can reach, and nothing else. It is not scoped
to a project, and it is not shared across a team - two people on one team hold
two different keys, and revoking one leaves the other working.

[`GET /v1/me`](/api/reference/operations/getme/) answers which user a key acts
as, which is the quickest way to tell two keys apart when a request is not
returning what you expected.

That makes revocation the tool for everything: someone leaves, a key leaks, a
script is retired - revoke that key and create a new one.

## Keeping keys safe

- Treat a key like a password: server-side only, out of git, out of the
  browser. Anyone holding it can render against your team's projects and spend
  the team's credits.
- Give each integration its own named key, so one can be revoked without
  stopping the others.
- Revoking is immediate and permanent - the next request with that key fails.