# Authentication

Every `/api/v1` request must carry an API key. Keys are created and revoked in **[Account → API keys](/account/api)**.

::callout{type="note"}
No account yet? [Sign up](/sign-up) first (email/password signups must verify their email before logging in) — see the [Quickstart](/docs/getting-started/quickstart#before-you-begin-create-an-account).
::

## Base URL

```text
https://llms-txt.io
```

## OpenAPI spec

The full `/api/v1` contract — endpoints, request/response schemas, and auth schemes — is published as a machine-readable spec at **[llms-txt.io/openapi.json](/openapi.json)**. Point your codegen tool or agent at it directly.

## Passing your key

Pass the key either as an `x-api-key` header **or** as a bearer token — whichever your HTTP client makes easier. Both are equivalent.

```bash
# x-api-key header
curl https://llms-txt.io/api/v1/generate \
  -H "x-api-key: llmstxt_sk_live_…" -X POST -d '{ "url": "example.com" }'

# Authorization: Bearer
curl https://llms-txt.io/api/v1/generate \
  -H "Authorization: Bearer llmstxt_sk_live_…" -X POST -d '{ "url": "example.com" }'
```

A missing or invalid key returns **401**:

```json
{ "statusCode": 401, "message": "Invalid or revoked API key." }
```

## Key security

- The raw key is shown **once**, at creation. We store only its SHA-256 hash, so it can't be recovered — revoke and recreate if you lose it.
- Revoking a key (in the dashboard) takes effect immediately; any integration using it stops working.
- Keys inherit your account's current plan. Upgrade and your existing keys gain the new limits automatically.

::callout{type="tip"}
Keep your key in an environment variable or secret store (`LLMSTXT_KEY`), never hard-coded in a committed file.
::

## Plan limits

Your plan sets monthly quotas and the per-minute rate limit applied to each key. See [Rate limits & errors](/docs/api/rate-limits-and-errors) for the numbers and headers.