> ## Documentation Index
> Fetch the complete documentation index at: https://docs.eggapi.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate EggAPI requests with API keys

EggAPI has two authentication modes in the product:

* Public server-to-server API calls use API keys.
* The website dashboard and admin tools use Better Auth session cookies.

This documentation covers the public API key flow.

## API Key Header

Send your key as a Bearer token on every public API request:

```text theme={null}
Authorization: Bearer YOUR_API_KEY
```

Example:

```bash theme={null}
curl https://api.eggapi.ai/v1/usage/summary \
  -H "Authorization: Bearer YOUR_API_KEY"
```

The backend rejects requests when the header is missing, the format is not `Bearer <token>`, the key is inactive or expired, or the owning user is not active.

## Creating Keys

Create and manage API keys from the EggAPI dashboard. API key creation is a dashboard session action; do not call it from backend jobs or customer-facing clients.

When a key is created, store it immediately. Treat it like a password and only use it from server-side code.

## Which Endpoints Accept API Keys

<CardGroup cols={2}>
  <Card title="Generation" icon="wand-magic-sparkles" href="/docs/en/api-reference/introduction">
    `POST /v1/generate` accepts API keys and also supports session auth for dashboard playground use.
  </Card>

  <Card title="Tasks" icon="clock" href="/docs/en/guides/async-tasks">
    `GET /v1/tasks/{id}` and `GET /v1/tasks` accept API keys and session auth.
  </Card>

  <Card title="Usage" icon="chart-line" href="/docs/en/api-reference/introduction">
    `GET /v1/usage` and `GET /v1/usage/summary` require API key authentication.
  </Card>

  <Card title="Dashboard" icon="user" href="https://eggapi.ai/dashboard">
    API key management, account balance, and webhook secret management use browser sessions.
  </Card>
</CardGroup>

## Security Practices

* Keep API keys on your server. Do not expose them in frontend JavaScript, mobile apps, public repositories, or logs.
* Use separate keys for production, staging, and local development.
* Rotate a key if it may have been exposed.
* Prefer a backend endpoint you control when browser users need to trigger EggAPI generation.

## Common Authentication Errors

```json theme={null}
{
  "data": null,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Missing Authorization header"
  }
}
```

```json theme={null}
{
  "data": null,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid Authorization format, expected 'Bearer <token>'"
  }
}
```

```json theme={null}
{
  "data": null,
  "error": {
    "code": "FORBIDDEN",
    "message": "User account is suspended"
  }
}
```