> ## Documentation Index
> Fetch the complete documentation index at: https://docs.spidra.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create an API key, send it with every request, and keep it safe. Keys are shown once and can be turned off or deleted at any time.

Every API request needs an API key. Keys start with `spd_`.

## Get a key

Your first key is created when you sign up. To add more, open [API Keys](https://app.spidra.io/dashboard/api-keys) in the dashboard, click **Create API key**, and give it a name that says where you'll use it ("Production", "Local", "Cursor").

The full key is shown **once**, when you create it. Spidra stores only a hashed copy, so it can't show it again. Copy it into an environment variable straight away:

```bash theme={null}
export SPIDRA_API_KEY="spd_YOUR_API_KEY"
```

If you lose a key, create a new one and delete the old one.

## Send the key

Put it in the `Authorization` header as a Bearer token:

```bash theme={null}
curl https://api.spidra.io/api/account \
  -H "Authorization: Bearer $SPIDRA_API_KEY"
```

The `x-api-key` header works too:

```bash theme={null}
curl https://api.spidra.io/api/account \
  -H "x-api-key: $SPIDRA_API_KEY"
```

The SDKs and the MCP server take the key once, when you create the client or configure the server.

## When it fails

| Response | Cause |
| - | - |
| `401` `{"status":"error","message":"Missing authentication"}` | No key in the request. |
| `401` `{"status":"error","message":"Invalid token or API key"}` | The key is wrong, deleted or turned off. |
| `403` with the body `error code: 1010` | Not a key problem. Your HTTP client's default user agent is blocked (Python's built-in `urllib` and Perl's `libwww-perl`). Use `requests`, `httpx`, `fetch`, curl or an SDK, or set a normal `User-Agent` header. |

## Manage your keys

The API Keys page lists each key with its name, the first and last characters, when it was created and when it was last used.

* **Turn a key off** with its switch. Requests with it are refused until you turn it back on. Use this if you think a key leaked but aren't ready to replace it.
* **Delete a key** to remove it for good. Anything still using it stops working straight away.
* Your only key can't be deleted. Turning off your only active key is allowed, after a warning, but then every API request fails until you turn it back on.

Spidra emails you whenever a new key is added to your account.

## Keep keys safe

* Keep keys in environment variables or a secrets manager, never in source code or front-end code.
* Use a separate key for each app or machine, so you can turn one off without breaking the others.
* If a key leaks, create a new one, switch your app to it, then delete the old one.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.