# Authentication

Every API request is authenticated with an API key, sent as a bearer token in the `Authorization` header.

## Create a key

1. Open [API keys](https://layahost.com/keys) in the console and choose **Create key**.
2. Name it after where it runs, for example `production` or `support-bot`.
3. Copy the key. It starts with `lh_` and is shown only once.

We store only a hash of each key, so we cannot show it again. If you lose a key, create a new one and revoke the old one. You can have up to 25 active keys per account.

## Send the key

Pass the key in the `Authorization` header on every request:

Header

```http
Authorization: Bearer lh_...
```

For example, to list the available models:

GET /v1/models

```bash
curl https://layahost.com/v1/models \
  -H "Authorization: Bearer $LAYAHOST_API_KEY"
```

The official Jev SDKs read the key from the `TYPESAFE_API_KEY` environment variable. Put your layahost key there and point the SDK at layahost, as described in [Migrate from Jev](https://layahost.com/docs/migrate-from-jev).

## Keep keys secret

- Call the API from your server, never from a browser or a mobile app, where anyone can read the key. The JavaScript SDK refuses to run in a browser unless you set `dangerouslyAllowBrowser`.
- Load keys from environment variables or a secrets manager, not from source code.
- Use one key per environment or service. Usage is tracked per key, and you can revoke one without touching the others.

## Revoke a key

Revoke a key on the [API keys](https://layahost.com/keys) page. It stops working immediately: requests that use it get a `401`. Revoking cannot be undone.

## Authentication errors

A request without a valid key gets `401 Unauthorized` with `error_type` set to `authentication_error`. These requests are not billed and do not count towards your [rate limit](https://layahost.com/docs/rate-limits).

No `Authorization` header:

Response · 401

```json
{
  "detail": {
    "error_type": "authentication_error",
    "message": "Missing API key. Send it as \"Authorization: Bearer <API_KEY>\"."
  }
}
```

A key that does not exist or has been revoked:

Response · 401

```json
{
  "detail": {
    "error_type": "authentication_error",
    "message": "Invalid or revoked API key."
  }
}
```

See [Errors](https://layahost.com/docs/errors) for every error type.