> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getstell.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate with the Stell API

> Send your Stell API key as a Bearer token: the key format, what a missing or invalid key returns, and why keys stay server-side.

The Stell API authenticates with **API keys**. You create and manage keys in the merchant portal. See [API keys](/api-reference/api-keys) for creating, rotating, and revoking them.

Keys start with `sk_prod_` followed by a random string. The full secret is shown once, when you create the key.

## Sending your key

Pass the key as a Bearer token in the `Authorization` header on every request:

```bash theme={null}
curl https://api.platform.getstell.com/v1/programs \
  --header "Authorization: Bearer sk_prod_your_key_here"
```

A missing or invalid key returns `401 Unauthorized`. A valid key requesting a resource that belongs to another company returns `403 Forbidden`.

## Keep keys server-side

<Warning>
  An API key grants **full read and write access** to your company's data,
  including issuing and voiding passes on customers' devices. Treat it like a
  password. Call the API from your servers only, and never embed a key in a
  website, mobile app, or anything else you ship to users.
</Warning>

Three habits keep keys manageable:

* Use one key per integration. Revoking one then never breaks the others.
* Store keys in your secrets manager, not in code or config files under version control.
* If a key may have leaked, [rotate it](/api-reference/api-keys#manage-keys) immediately. The old secret stops working at once.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.