> ## Documentation Index
> Fetch the complete documentation index at: https://docs.apistable.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Website sessions and application API keys serve different purposes.

> API preview: generation providers are not connected. An authenticated request can return 503 without creating a task or charging credits.

## Use a Bearer key

External applications authenticate with an API key in the Authorization header. Browser access to your developer console uses a login session instead. A login cookie is not a replacement for your application key.

```http theme={null}
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json
```

## Account and key boundaries

Every operation belongs to an account. A key can only access that account’s resources and the actions allowed by its scopes. Guessing another task ID never grants access.

Current scopes include generations:write and usage:read. Revoking a key blocks subsequent authenticated calls. Before paid provider execution opens, key budgets must also include settled spending and outstanding reservations; a configured budget field alone is not enforcement.

## Rotate without losing history

* Create a replacement key, update your server, verify access, then revoke the old key.
* Revocation does not cancel in-flight tasks or refund completed work. Use the console or another authorized key to follow existing tasks.
* Never include a full key when sharing logs or asking for help. Share the request ID instead.

[Open API Keys](https://apistable.com/console/keys)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.