# Authentication (/docs/api-reference/authentication)



All API requests require authentication using an API key. Keys start with
`cc_`. Include your API key in the `x-api-key` header:

```bash
x-api-key: YOUR_API_KEY
```

Obtaining API Keys [#obtaining-api-keys]

Production Keys [#production-keys]

API keys for production use can be generated from the [Developer Dashboard](https://app.carecycle.ai/settings/developer/api-keys):

1. Log in and navigate to the [API Keys page](https://app.carecycle.ai/settings/developer/api-keys)
2. Click **Create API Key**
3. Give your key a descriptive name and select the exact capabilities it needs
4. Copy and securely store your API key; it will only be shown once

<Callout type="warn">
  Keep your API keys secure. Do not share them in public repositories, client-side code, or expose them in logs. If you believe a key has been compromised, revoke it immediately and generate a new one.
</Callout>

Testing in the API Playground [#testing-in-the-api-playground]

You can generate a temporary API key directly from the API reference pages to quickly test endpoints in the interactive playground.

1. Make sure you are logged in.
2. Navigate to any API reference page (e.g., [List Campaigns](/docs/api-reference/campaigns/list-campaigns))
3. Open the **Authorization** section in the playground
4. Click **Generate API Key**
5. If you belong to multiple organizations, select which one to create the key for

<Callout type="info">
  Playground keys expire after **14 days**, grant only the documented read capabilities, and are intended for testing only. For production integrations, generate a key from the [Developer Dashboard](https://app.carecycle.ai/settings/developer/api-keys).
</Callout>

Failed authentication [#failed-authentication]

Requests with a missing or invalid key return `401 Unauthorized` with the
`UNAUTHORIZED` code. A valid key that lacks the capability an endpoint needs
returns `403 Forbidden` with the `FORBIDDEN` code. See [Errors](/docs/api-reference/errors)
for the response format and how to recover from each code.

Related [#related]

* [Rate limits](/docs/api-reference/rate-limits): how many requests each key can make.
* [Errors](/docs/api-reference/errors): the error format and every error code.
* [Versioning](/docs/api-reference/versioning): how API paths are versioned.
* [SDKs](/docs/api-reference/sdks): generate a typed client from the OpenAPI spec.