---
url: https://commerceai.ai/docs/guide/authentication.md
---
# Authentication

All requests to CommerceAI are authenticated with an API key passed as a bearer token.

```http
Authorization: Bearer <YOUR_API_KEY>
```

API keys start with `sk-`.

## Managing keys

You can create up to **5 active keys** per account in **Dashboard → API Keys**. Each key shows:

* A name you choose, for example `prod-assistant`
* A masked version of the key
* Its active or revoked status
* Created and last-used time

## Rotating a key

1. Create a new key and deploy it alongside the old one.
2. Watch the **Last used** column until the old key stops receiving traffic.
3. Revoke the old key.

::: danger Revoking is immediate
Requests using a revoked key fail with `401 UNAUTHENTICATED` right away. There is no grace period and revoked keys cannot be restored.
:::

## Troubleshooting

::: details I get 401 even though the key is correct
Check that the header is `Authorization: Bearer <key>` with a single space and no quotes around the key. Keys copied from some terminals may include a trailing newline.
:::