# Authentication


All public API operations authenticate with an API key sent as a bearer
token:

```
Authorization: Bearer atk_...
```

Keys carry the `atk_` prefix. There are no query-string or cookie
alternatives for programmatic access.

## What a key is

A key belongs to your organization and acts as it: actions run against the
organization's data and are billed to it. Keys are named, revocable, and
track last use; the secret is shown once at creation.

A key's lifecycle is tied to the member who created it — removing that member
deletes every key they created. Re-key an integration under a surviving
member before an offboarding.

## What a key may do — and never do

- **Keys cannot mint keys.** Key creation and revocation are not on this
  surface at all; they happen in the dashboard, by a signed-in person.
- **Billing, plans, and impersonation are not on this surface.** Those
  operations exist only where a person is signed in; you will not find them
  in this reference, by construction.
- **Administration is capped at the creator's role.** A key may perform the
  administrative operations in this reference (for example managing members)
  only at or below the role of the member who created it — a key never
  escalates above its creator.
- **Feature flags narrow further.** At creation a key's flags can never
  exceed its creator's; afterwards the key is capped by the organization's
  entitlement. An operation refused on a flag answers `403` naming the
  missing flag.

Owners and admins can see and revoke every key in the organization; members
see only the keys they created.

## Failure modes

| Response | Meaning |
| --- | --- |
| `401 missing bearer token` | No `Authorization: Bearer ...` header. |
| `401 invalid or expired token` | The key is unknown or revoked. |
| `403` | Authenticated, but this key may not perform the operation. |

See [Errors](/errors) for the full picture.