# Authentication and keys

How to send your API key, what a key may reach, when it runs out, and how to limit what one key may spend in a month.

## Send your key

Every request carries your key, in either header:

```http
Authorization: Bearer tenx_...
x-api-key: tenx_...
```

A key acts as you, in your own workspace, and only on the API's routes. It never opens the app.

## Make a key

Open the [API keys](/app/api-keys) page in the app and press **Create key**. Give it a name you will recognise, such as the server it runs on. The key is shown once: we keep a fingerprint of it, never the key itself. An account can have 20 keys. Your email address must be confirmed before you can make one.

The list shows each key's name, its last four characters, when it was made, when it runs out and a switch. Its menu has **Edit**, **Copy key ID** and **Delete**.

## Restrict a key

A key that is not restricted reaches every part of the API. Turn on **Restrict key** to choose:

| Part | Levels | What it allows |
|---|---|---|
| Formats | No access, Read, Write | Read formats; Write also makes, continues and deletes them |
| Videos | No access, Read, Write | Read videos; Write also makes them |
| Image ads | No access, Read, Write | Read image ads; Write also makes them |
| Styles | No access, Read | List the styles |
| Account | No access, Read | Read the credits, balance and prices |

A restricted key can also have a **monthly limit**: the most it may spend in a calendar month, counted in dollars at the API's prices, whichever of your credits or your balance pays. A key past its limit is refused with `402` and `"code": "limit"`.

## When a key runs out

Choose **Expire after** when you make a key: never, or after a number of days. Change it at any time with **Edit**. The switch beside each key turns it off without deleting it, and on again.

## When a key is refused

| Status | Code | Why |
|---|---|---|
| `401` | `key` | No key was sent, the key is not one, it was deleted, it is switched off, or it ran out. The `error` says which. |
| `403` | `scope` | The key may not reach this part of the API. |
| `402` | `limit` | The key's monthly limit cannot pay for this. |

## Keep keys safe

Use a key only on your own server, never in a web page or an app people download. Give each place its own key, so one can be deleted without stopping the others. If a key leaks, delete it: it stops working at once.