> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getstell.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate API requests with your company's API key

The Stell API authenticates with **API keys**. You create and manage keys in the merchant portal. See [API keys](/account/api-keys) for creating, rotating, and revoking them.

Keys start with `sk_prod_` followed by a random string. The full secret is shown once, when you create the key.

## Sending your key

Pass the key as a Bearer token in the `Authorization` header on every request:

```bash theme={null}
curl https://api.platform.getstell.com/v1/programs \
  --header "Authorization: Bearer sk_prod_your_key_here"
```

A missing or invalid key returns `401 Unauthorized`. A valid key requesting a resource that belongs to another company returns `403 Forbidden`.

## Keep keys server-side

<Warning>
  An API key grants **full read and write access** to your company's data,
  including issuing and voiding passes on customers' devices. Treat it like a
  password. Call the API from your servers only, and never embed a key in a
  website, mobile app, or anything else you ship to users.
</Warning>

Three habits keep keys manageable:

* Use one key per integration. Revoking one then never breaks the others.
* Store keys in your secrets manager, not in code or config files under version control.
* If a key may have leaked, [rotate it](/account/api-keys#manage-keys) immediately. The old secret stops working at once.