> ## Documentation Index
> Fetch the complete documentation index at: https://docs.limitly.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# API Authentication

> Learn how to authenticate with the Limitly API

All requests to the Limitly API require authentication using your API key.

## Authentication Method

Limitly uses **Bearer Token** authentication. Include your API key in the `Authorization` header:

```bash theme={null}
curl -H "Authorization: Bearer lk_1234567890abcdef1234567890abcdef" \
     https://api.limitly.dev/functions/v1/keys
```

## API Key Format

Limitly API keys follow this format:

* **Prefix**: `lk_`
* **Length**: 32 characters
* **Example**: `lk_1234567890abcdef1234567890abcdef`

## Getting Your API Key

1. Log in to your [Limitly Dashboard](https://app.limitly.com)
2. Navigate to the **API Keys** section
3. Create a new API key or copy an existing one
4. Use this key in your API requests

## Example Requests

### JavaScript (Fetch)

```javascript theme={null}
const response = await fetch('https://api.limitly.dev/functions/v1/keys', {
  headers: {
    'Authorization': 'Bearer lk_1234567890abcdef1234567890abcdef',
    'Content-Type': 'application/json'
  }
});

const data = await response.json();
```

### cURL

```bash theme={null}
curl -X GET \
  -H "Authorization: Bearer lk_1234567890abcdef1234567890abcdef" \
  -H "Content-Type: application/json" \
  https://api.limitly.dev/functions/v1/keys
```

## Error Responses

If authentication fails, you'll receive a `401 Unauthorized` response:

```json theme={null}
{
  "error": "Invalid API key",
  "code": "INVALID_API_KEY"
}
```

## Security Best Practices

<CardGroup cols={1}>
  <Card title="Environment Variables">
    Store your API key in environment variables, never in your source code:

    ```bash theme={null}
    # .env
    LIMITLY_API_KEY=lk_1234567890abcdef1234567890abcdef
    ```

    ```javascript theme={null}
    const apiKey = process.env.LIMITLY_API_KEY;
    const response = await fetch('https://api.limitly.dev/functions/v1/keys', {
      headers: {
        'Authorization': `Bearer ${apiKey}`,
        'Content-Type': 'application/json'
      }
    });
    ```
  </Card>
</CardGroup>

<CardGroup cols={1}>
  <Card title="Key Rotation">
    Regularly rotate your API keys for enhanced security. You can regenerate keys from your dashboard without affecting your application.
  </Card>
</CardGroup>

<CardGroup cols={1}>
  <Card title="HTTPS Only">
    Always use HTTPS when making API requests. Limitly only accepts requests over HTTPS.
  </Card>
</CardGroup>

## Rate Limiting

The Limitly API itself is rate limited. You can make up to 1000 requests per minute per API key.

If you exceed this limit, you'll receive a `429 Too Many Requests` response:

```json theme={null}
{
  "error": "Rate limit exceeded",
  "code": "RATE_LIMIT_EXCEEDED"
}
```

## Next Steps

* [Request Validation](/rest-api/validation) - Learn how to validate user requests
* [API Key Management](/rest-api/api-keys) - Manage API keys for your users
* [Plans](/rest-api/plans) - Create and manage usage plans