> ## Documentation Index
> Fetch the complete documentation index at: https://developer.swytcho.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Swytcho API Authentication: Keys, Headers & Security

> Authenticate Swytcho API requests with a Bearer token, obtain and rotate API keys from the dashboard, and follow best practices to protect credentials.

Every request to the Swytcho API must be authenticated with an API key. You pass your key as a Bearer token in the `Authorization` header of each HTTP request. Requests that omit the header or supply an invalid key are rejected immediately with a `401 Unauthorized` response.

## Header Format

Include the following header in every API request, replacing `YOUR_API_KEY` with your actual key:

```http theme={null}
Authorization: Bearer YOUR_API_KEY
```

## Example Request Headers

<CodeGroup>
  ```bash curl theme={null}
  curl https://api.swytcho.com/v1/models \
    -H "Authorization: Bearer YOUR_API_KEY" \
    -H "Content-Type: application/json"
  ```

  ```python Python theme={null}
  import os
  from swytcho import Swytcho

  client = Swytcho(api_key=os.environ["SWYTCHO_API_KEY"])
  ```

  ```javascript Node.js theme={null}
  import Swytcho from "swytcho";

  const client = new Swytcho({
    apiKey: process.env.SWYTCHO_API_KEY,
  });
  ```
</CodeGroup>

## Obtaining an API Key

Generate and manage your API keys from the [Swytcho Dashboard](https://app.swytcho.com/settings/api-keys). Each key is shown only once at creation time — copy it immediately and store it securely. If you lose a key, revoke it and generate a new one.

## Security Best Practices

Follow these practices to keep your API key safe:

* **Use environment variables.** Store your key in an environment variable such as `SWYTCHO_API_KEY` and read it at runtime. Never hard-code it in source files.
* **Add key files to `.gitignore`.** If you use a `.env` file locally, make sure it is listed in `.gitignore` so it is never committed to version control.
* **Rotate keys periodically.** Generate a new key on a regular schedule and revoke the old one to limit the blast radius of any undetected exposure.
* **Use separate keys per environment.** Maintain distinct keys for development, staging, and production so you can revoke a compromised key without affecting all environments.
* **Restrict key scope where possible.** The dashboard lets you assign keys to specific projects — use the narrowest scope that satisfies your use case.

<Warning>
  Never expose your API key in client-side code, public repositories, logs, or error messages. Anyone who obtains your key can make requests that are billed to your account. If you suspect a key has been compromised, revoke it immediately from the [Swytcho Dashboard](https://app.swytcho.com/settings/api-keys).
</Warning>

## Authentication Errors

When a request fails authentication, the API returns a `401 Unauthorized` status code with a JSON error body:

```json theme={null}
{
  "error": {
    "type": "authentication_error",
    "message": "Invalid API key provided. Ensure your Authorization header is set to 'Bearer YOUR_API_KEY'.",
    "code": "invalid_api_key"
  }
}
```

Common causes of `401` errors include:

| Cause                                       | Fix                                                            |
| ------------------------------------------- | -------------------------------------------------------------- |
| Missing `Authorization` header              | Add `Authorization: Bearer YOUR_API_KEY` to every request      |
| Malformed header (e.g., no `Bearer` prefix) | Ensure the value is exactly `Bearer <key>` with a single space |
| Revoked or deleted key                      | Generate a new key from the dashboard                          |
| Key copied with leading/trailing whitespace | Trim whitespace before storing or passing the key              |