# Authentication

Every request needs an API key. Send it either way:

```bash tab="Bearer"
curl https://api.happyfetch.net/v1/company \
  -H "Authorization: Bearer $HAPPYFETCH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "stripe"}'
```

```bash tab="X-Api-Key"
curl https://api.happyfetch.net/v1/company \
  -H "X-Api-Key: $HAPPYFETCH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "stripe"}'
```

## Keys

- Keys look like `hf_live_` followed by 32 characters. We store only a hash, so a key is shown once,
  when you create it.
- A key belongs to a **workspace**. Calls draw on that workspace's credits and appear in its usage and
  ledger. Everyone in the workspace sees the same numbers.
- Create as many keys as you like, for example one per service. The console shows when each was last
  used, and usage can be filtered per key.
- **Revoke** a key in the console and it stops working immediately. To rotate, create the new key,
  deploy it, then revoke the old one.

## When a key is wrong

A missing, malformed or revoked key gets `401` with the code [`unauthorized`](/docs/errors#unauthorized).
It's never charged.

Keep keys on your servers. Anyone holding a key can spend its workspace's credits.