---
title: Authentication
url: https://runapi.ai/docs/guides/authentication.md
canonical: https://runapi.ai/docs/guides/authentication
locale: en
---

# Authentication

RunAPI uses API keys to authenticate API requests. Send the key with
every request that accesses your account or creates work.

## Choose the right key

* A standard API key calls the Task API, LLM API, and account endpoints.
  Create it from the [API Keys page](/api_keys).
* A management key creates and governs standard API keys and guardrails.
  Create it from the [Management Keys page](/management_keys) and use it
  only with Platform Management endpoints.

## Create an API key

Give each application its own key so you can rotate or revoke access
without interrupting other integrations. A key is bound to one account,
and requests can access only resources visible to that account.

## Authenticate a request

Send the API key as a bearer token in the `Authorization` header:

```http
Authorization: Bearer YOUR_API_TOKEN
```

For example, request your current balance with cURL:

```shell
curl "https://runapi.ai/api/v1/me/balance" \
  -H "Authorization: Bearer YOUR_API_TOKEN"
```

## Keep keys secure

* Store API keys in a secret manager or encrypted credentials.
* Never commit a key to source control or expose it in browser code.
* Rotate a key immediately if it may have been disclosed.
* Use separate keys for development and production.

## Troubleshoot authentication

* A `401 Unauthorized` response means the key is missing, malformed,
  revoked, or invalid.
* A `403 Forbidden` response means the key is valid but its credential
  class or account role cannot perform the operation.
* Confirm the header starts with `Bearer`, followed by one space and the
  complete key.
* Confirm the key belongs to the account whose resources you are
  requesting.