> ## Documentation Index
> Fetch the complete documentation index at: https://wordsmithai.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Learn how to authenticate your API requests using API keys with the Wordsmith API.

The Wordsmith API uses API keys for authentication. All API requests must include a valid API key in the Authorization header.

## Getting Your API Key

1. Log in to your Wordsmith dashboard at [app.wordsmith.ai](https://app.wordsmith.ai)
2. Navigate to the API section in your account settings
3. Generate a new API key
4. Copy and store your API key securely

<Warning>
  Keep your API key secure and never share it publicly. Treat it like a
  password.
</Warning>

## Using Your API Key

Include your API key in the `Authorization` header of every request using the Bearer token format:

```bash theme={null}
Authorization: Bearer sk-ws-api1-your_api_key_here
```

## Example Request

Here's an example of making an authenticated request to get your user information:

```bash theme={null}
curl -X GET "https://api.wordsmith.ai/api/v1/me" \
  -H "Authorization: Bearer sk-ws-api1-your_api_key_here" \
  -H "Content-Type: application/json"
```

## API Key Format

Wordsmith API keys have the following format:

* They start with the prefix `sk-ws-api1-`
* Followed by a unique identifier

Example: `sk-ws-api1-abc123def456ghi789`

## Error Responses

If authentication fails, you'll receive a `401 Unauthorized` response with a JSON body. See the [Errors](/errors) page for the full error format reference.

### Missing Authorization Header

```json theme={null}
{
  "error_code": "unauthorized",
  "ws_api_error_code": "unauthorized",
  "message": "Missing Authorization header"
}
```

### Invalid API Key Format

```json theme={null}
{
  "error_code": "unauthorized",
  "ws_api_error_code": "unauthorized",
  "message": "Invalid API key format"
}
```

### Invalid API Key

```json theme={null}
{
  "error_code": "unauthorized",
  "ws_api_error_code": "unauthorized",
  "message": "Invalid API key"
}
```

## Security Best Practices

* **Store securely**: Keep your API key in environment variables or secure configuration files
* **Use HTTPS**: Always make requests over HTTPS
* **Rotate regularly**: Periodically rotate your API keys
* **Monitor usage**: Keep track of your API usage to detect any unauthorized access
* **Restrict access**: Only use API keys in server-side applications, never in client-side code

## Rate Limiting

API keys are subject to rate limits based on your subscription plan. When you exceed these limits, you'll receive a `429 Too Many Requests` response.