# Authentication

> Every request carries your API key as a bearer token.

Source: https://www.lyber.ai/docs/api/authentication/ · Markdown: https://www.lyber.ai/docs/md/api/authentication.md

```http
Authorization: Bearer lyber_prepaid_…
```

Keys are `lyber_prepaid_` followed by 64 hexadecimal characters. Create, name, limit and rotate them under [API keys](https://www.lyber.ai/dashboard/keys/). A key spends its account's prepaid credit; a website sign-in never stands in for a key.

## Errors

| Status | Code | Meaning |
| --- | --- | --- |
| `401` | `authentication_error` | The key is missing, malformed, revoked or unknown. |
| `401` | `api_key_expired` | The key has expired. Create a new one. |
| `403` | `access_approval_required` | The account isn't approved yet. [Request access](https://www.lyber.ai/access/). |
| `403` | `model_not_allowed` | This key isn't allowed to use the model. |

## Keep keys secret

- Read keys from the environment or a secret manager. Never commit them, log them or ship them in browser or mobile code.
- Use one key per app or agent, each with its own monthly limit, so one leak or runaway loop is contained.
- If a key leaks, revoke it in the dashboard. A key can read its limits but never raise them.