> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airscale.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create, send, protect, and rotate an Airscale API key.

Airscale authenticates API requests with a workspace API key sent as a Bearer token.

## Create an API key

Create the key in **Airscale Settings**: open the [Airscale dashboard](https://app.airscale.io/dashboard), choose **Settings → API key**, and generate a key for your integration.

Store the value in your server's secret manager or environment configuration:

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
export AIRSCALE_API_KEY="YOUR_API_KEY"
```

## Send the key

Include this header on every API request:

```text theme={"theme":{"light":"github-light","dark":"github-dark"}}
Authorization: Bearer $AIRSCALE_API_KEY
```

## Job-change monitoring keys

Job-change monitoring requires a **V2 workspace API key**. Legacy V1 API keys are not supported by the `/v1/job-change-monitors` endpoints. Use the key from your V2 workspace; monitors and monitoring credits belong to that workspace.

New hire monitoring (`/v1/new-hire-monitors`) and post engagement monitoring (`/v1/post-engagement-monitors`) have the same requirement: use a V2 workspace API key. An unknown key returns `401` with `{"error": {"code": "invalid_api_key", "message": "The API key is not valid"}}`.

## Handle unauthorized requests

A missing Bearer token or an invalid API key returns `401 Unauthorized`. Check that the header is present, that it starts with `Bearer`, and that your deployed secret contains the current key before retrying.

> [!WARNING]
>
> Keep API keys server-side. Never commit them to source control, place them in examples, or expose them in browser or mobile client bundles.

## Rotate a compromised key

If a key is exposed, rotate it immediately in **Airscale Settings**. Update the server-side secret, deploy the new value, verify an authenticated request, and stop using the old key.

Next, review [Rate limits](https://docs.airscale.io/api-reference/rate-limits.md) before adding request concurrency or retries.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.