Authentication

Authenta's API uses a bearer token authentication mechanism.
Every request must include your API Key in the Authorization header.

This page explains how to authenticate with the API and how authentication-related errors are returned.

How Authentication Works

Every API request must include:

Authorization header – Bearer token format with your API key

Your API key is generated when you create an API key in your console and acts as your authentication credential.

Required Authentication Header

All API requests must include the following header:

Authorization: Bearer api_xxxxxxxx...

Example request:

GET /api/v1/jobs HTTP/1.1
Host: platform.authenta.ai
Authorization: Bearer api_xxxxxxxx...

Example in cURL

curl -X GET "https://platform.authenta.ai/api/v1/jobs" \
  -H "Authorization: Bearer api_xxxxxxxx..."

Example in JavaScript (Node.js)

const res = await fetch('https://platform.authenta.ai/api/v1/jobs', {
  headers: {
    'Authorization': `Bearer ${process.env.AUTHENTA_API_KEY}`,
  },
});
 
const body = await res.json();
console.log(body);

Example in Python

import requests
 
headers = {
    "Authorization": f"Bearer {API_KEY}"
}
 
response = requests.get("https://platform.authenta.ai/api/v1/jobs", headers=headers)
print(response.json())

Authentication Error Responses

Errors use the standard error shape: rid (request ID), name (the error code to branch on) and message.

Status	`name`	When
`401`	`UNAUTHENTICATED`	No `Authorization` header, or it isn't in the form `Bearer api_...`
`401`	`INVALID_API_KEY`	The key is unknown, revoked or expired
`403`	`FORBIDDEN`	The key is valid but lacks the permission the endpoint needs (for example a Read-only key calling `POST /jobs`)

Example Response

{
  "rid": "9b6f1d2e-5c1a-4b7e-8f3d-2a1c0e9d8b7a",
  "name": "INVALID_API_KEY",
  "message": "API key authentication failed"
}

None of these succeed on retry. Fix the key or its permissions in Settings → API Keys. Credit errors (402) are covered in Quotas & Credits.

Best Practices for Authentication

🔒 1. Keep your API Key private

Store it using environment variables or secret managers. Never hard-code it into your source code.

🔑 2. Use separate keys for separate environments

Production, staging, CI, automation, etc.

🔄 3. Rotate keys periodically

You can regenerate your API key anytime for enhanced security.

📱 4. Never put a key in a mobile app or browser

Anything shipped to a device can be extracted. Call Authenta from your own backend instead; see Keeping keys safe.

📉 5. Monitor usage & credit balance

Track your credit usage to avoid running out of credits mid-operation.

Next Steps

Once authentication is set up: