# Authentication

> Available at launch

API keys, how to send them and how to keep them safe.

## Keys

Every request carries an API key in the `Authorization` header:

```
Authorization: Bearer $ARCADIUM_API_KEY
```

Keys start with `arc_live_`. We store only a hash of each key, so the full key is shown once, when you create it. If you lose it, revoke it and create a new one.

## One key, every scraper

A key works for every scraper and spends from your account's balance. You can create several keys, for example one per project, and set a daily spending cap on each.

## Keep keys out of code

- Read the key from an environment variable or a secret manager.
- Never put it in a browser page or a public repository.
- Revoke a key the moment you think it has leaked, then create a new one.

## Errors

A missing or wrong key answers `401` with a body like this:

```json
{ "error": { "code": "unauthorized", "message": "Missing or invalid API key.", "requestId": "req_..." } }
```

Every error uses the same shape. Quote the `requestId` when you write to us about a failed call.