> ## Documentation Index
> Fetch the complete documentation index at: https://docs.spirii.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to get access to the Spirii Public API and authorize requests.

All Spirii Public API requests must be authenticated. The API uses **bearer tokens** sent in the `Authorization` header.

## Create an API key

Create an API key via Spirii Connect. Navigate to [API tokens](https://connect.spirii.com/team?activeTab=api_tokens\&limit=24\&page=1) under Team Access.

Upon creation, you will receive your unique API key via a secure one-time link. This link can only be opened once, so ensure you store your key securely after accessing it.

<Warning>
  Only Spirii Connect users with an **Operator** role or higher can create API tokens.
</Warning>

## Authorize a request

Send the key in the `Authorization` header, prefixed with `Bearer`:

```http theme={null}
Authorization: Bearer YOUR_API_KEY
```

## Security best practices

<Info>
  Treat API keys like passwords. Never commit them to source control or embed them in mobile apps or front-end bundles.
</Info>

* Store keys in a secret manager or environment variables — never in code.
* Rotate keys regularly. To rotate without downtime: provision a new key, roll it into your application, then revoke the old one.
* Restrict outbound calls to the Spirii API to known IP ranges where possible.