> ## Documentation Index
> Fetch the complete documentation index at: https://docs.intentleads.si/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, what standard and admin keys can do, and keeping them safe.

Every API request needs an API key, sent as a bearer token:

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl https://intentleads.si/api/v1/me \
  -H "Authorization: Bearer il_live_..."
```

Keys belong to one organization and only ever see that organization's lanes, leads and usage.

## Creating a key

Open **API and CLI** in the [dashboard](https://intentleads.si/dash/api) and create a key. The full key is shown once, when you create it. We only store a hash of it, so we can't show it again. If you lose it, rotate it.

## Standard and admin keys

| | Standard | Admin |
| - | - | - |
| Lanes, keywords, checks, samples | ✓ | ✓ |
| Quotes, exports and leads | ✓ | ✓ |
| Suppressions, usage, activity | ✓ | ✓ |
| Billing: change plan, billing page link | | ✓ |
| Team: invites, roles, removing people | | ✓ |
| API keys: create, rename, rotate, revoke | | ✓ |

Use standard keys for integrations and scheduled jobs. Only owners can create admin keys, and an admin key can only be managed by an owner or another admin key. Admin-only endpoints are marked in the [API reference](/api-reference/introduction).

## Rotating and revoking

* **Rotate** gives the key a new secret and keeps its name and role. The old secret stops working straight away.
* **Revoke** switches a key off for good.

You can do both in the dashboard, or with an admin key through `POST /api/v1/keys/{id}/rotate` and `DELETE /api/v1/keys/{id}`.

## Keeping keys safe

<Warning>
  An API key can export leads, and exports use your plan's contacts. Treat keys like passwords.
</Warning>

* Keep keys in environment variables or a secrets manager, never in code or URLs.
* Use a separate key per integration so you can revoke one without breaking the others.
* Check `last_used_at` in the dashboard or `GET /api/v1/keys` to spot keys nobody uses any more.

## Errors

| Status | `error` | Meaning |
| - | - | - |
| 401 | `unauthorized` | Missing, malformed, revoked or unknown key. |
| 403 | `admin_key_required` | The endpoint needs an admin key. |

See [Errors](/errors) for the full list.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.