> ## Documentation Index
> Fetch the complete documentation index at: https://docs.syrto.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate to the Syrto API with a bearer API key.

Every endpoint requires an API key. The same key identifies you and determines which endpoints you can call.

## Getting a key

Once Syrto has provisioned an API for your organization, admins create and revoke API keys in the [Syrto dashboard](https://dashboard.syrto.ai/api-keys). Each key is scoped to your organization.

## Sending your key

Pass the key as a bearer token in the `Authorization` header:

```
Authorization: Bearer sk_...
```

Keys begin with `sk_`. Keep them secret - a key grants access to your data and consumes your usage. Send every request over HTTPS, and never place a key in a URL.

The examples in these docs read the key from a `SYRTO_API_KEY` environment variable, so you can export it once and run any example:

```bash theme={null}
export SYRTO_API_KEY=sk_...

curl -s -H "Authorization: Bearer $SYRTO_API_KEY" \
  https://api.syrto.ai/companies/01654010345/financials
```

## Authentication errors

| Code               | HTTP  | When                                                                                          |
| ------------------ | ----- | --------------------------------------------------------------------------------------------- |
| `missing_api_key`  | `401` | No `Authorization` header, or it isn't a bearer token.                                        |
| `invalid_api_key`  | `401` | The key is not recognised.                                                                    |
| `auth_unavailable` | `503` | Key validation is temporarily unavailable. Retry after a short wait - do not rotate your key. |

<Warning>
  A `503 auth_unavailable` means the service could not verify your key right now, not that your key is wrong. Retry with backoff; rotating the key won't help.
</Warning>

Each error response follows the standard [error envelope](/api/errors):

```json theme={null}
{
  "error": {
    "code": "missing_api_key",
    "message": "Missing API key.",
    "requestId": "req_018f9c2e7b7a7c3e9a1b2c3d4e5f6a7b"
  }
}
```

## Your endpoints and spec

Your key is scoped to the endpoints included in your plan. To see exactly which endpoints and schemas your key can access, fetch your own [OpenAPI spec](/api/openapi) - it is generated per key and contains only the endpoints you're offered.