> ## Documentation Index
> Fetch the complete documentation index at: https://docs.yourproducthere.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, Bearer headers, and environment prefixes.

All authenticated routes require:

```http theme={null}
Authorization: Bearer <your_api_key>
```

## Key format

| Environment | Prefix         | Example               |
| ----------- | -------------- | --------------------- |
| Production  | `yph_sk_live_` | `yph_sk_live_a1b2c3…` |

Keys are tied to your organization. The key hash is stored server-side; the full secret is shown only when created or regenerated in **Developer**.

## Obtaining a key

To generate a programmatic API key:

<Warning>
  **API Activation Required**\
  API access is disabled for organizations by default. You must contact Michel ([michel@yourproducthere.ai](mailto:michel@yourproducthere.ai)) to enable API access for your organization before proceeding.
</Warning>

1. Once API access is enabled by Michel, sign in to [Your Product Here](https://yourproducthere.ai).
2. Open [**Developer**](https://yourproducthere.ai/app/developer) in your sidebar.
3. Click **Regenerate API key**.
4. Copy the key prefix and token immediately — it will not be shown again.

You can view the active key **prefix** anytime in Developer; use it to identify which key is in use without exposing the secret.

## Security practices

* Store keys in a secrets manager (never in client-side code or public repos).
* Use your keys securely against the production API base URL.
* Rotate keys from Developer if a key may have leaked; old keys stop working immediately.

## Unauthorized responses

```json theme={null}
{ "error": "Unauthorized" }
```

HTTP `401` — invalid or missing Bearer token.

```json theme={null}
{ "error": "api_access_disabled", "code": "API_ACCESS_DISABLED" }
```

HTTP `403` — org exists but API access was not enabled by admin.

## Public routes

Only `GET /health` is unauthenticated.