> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cromos.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Every request to the API carries a key.

## Get a key

Create one in the console under **Settings → API keys**. The key is shown once, when it is
created — copy it then. If you lose it, revoke it and create another.

Keys look like this:

```
cs_sk_yA7fQ2mR9vK4xN1pL6wT8zB3cJ5hD0gS2eV4nM7uX9k
```

Treat one like a password: keep it in an environment variable, never in client-side code or
a public repository. These are server keys — the API is not designed to be called from a
browser.

## Send it

Every request to `/v1/*` carries the key in an `Authorization` header:

```bash theme={null}
curl https://api.cromos.so/v1/expansions \
  -H "Authorization: Bearer cs_sk_yA7fQ2mR9vK4xN1pL6wT8zB3cJ5hD0gS2eV4nM7uX9k"
```

## When a request is refused

A missing, malformed, unknown, revoked or expired key all return the same response:

```json theme={null}
{ "data": null, "error": { "code": "unauthorized", "message": "a valid api key is required" } }
```

They are deliberately indistinguishable. If a request you expect to work is refused, check
the key's status in the console rather than reading anything into the response.

## Rate limits

Each key carries its own request budget. See [Rate limits](/rate-limits).

## Revoking and expiry

Revoking takes effect immediately — the next request with that key is refused. A key with an
expiry stops working the moment it passes, with no warning to the caller, so set a calendar
reminder if you use one.

Revoked keys stay listed in the console with their last-used date, so you can tell whether
anything was still calling with a key before you removed it.