> ## Documentation Index
> Fetch the complete documentation index at: https://docs.livchat.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Secure your API requests with API keys

# Authentication

All API requests require authentication using an API key.

## Getting Your API Key

1. Log in to [livchat.ai/dashboard](https://livchat.ai/dashboard)
2. Navigate to **Settings > API Keys**
3. Click **Create API Key**
4. Copy your key immediately (it won't be shown again)

<Warning>
  Store your API key securely. Never expose it in client-side code or public repositories.
</Warning>

## Using Your API Key

Include your API key in the `Authorization` header:

```bash theme={null}
curl https://api.livchat.ai/v1/session/status \
  -H "Authorization: Bearer lc_live_YOUR_API_KEY"
```

## API Key Types

| Prefix     | Environment | Usage                   |
| ---------- | ----------- | ----------------------- |
| `lc_live_` | Production  | Live WhatsApp messages  |
| `lc_test_` | Test        | Testing and development |

## Scopes

API keys have scopes that limit what they can access:

| Scope               | Access                                |
| ------------------- | ------------------------------------- |
| `whatsapp:*`        | Full access to all WhatsApp endpoints |
| `whatsapp:messages` | Send and manage messages              |
| `whatsapp:contacts` | Access contact information            |
| `whatsapp:session`  | Manage WhatsApp session               |
| `whatsapp:groups`   | Manage groups                         |
| `whatsapp:webhook`  | Configure webhooks                    |

## Error Responses

### 401 Unauthorized

```json theme={null}
{
  "error": {
    "code": 401,
    "message": "Invalid API key"
  }
}
```

**Causes:**

* Missing `Authorization` header
* Invalid or expired API key
* Malformed key format

### 403 Forbidden

```json theme={null}
{
  "error": {
    "code": 403,
    "message": "API key does not have required scope: whatsapp:messages"
  }
}
```

**Causes:**

* API key doesn't have permission for the requested endpoint
* Request a new key with the required scopes

## Best Practices

<AccordionGroup>
  <Accordion title="Use environment variables">
    Store API keys in environment variables, not in code:

    ```bash theme={null}
    export LIVCHAT_API_KEY="lc_live_..."
    ```
  </Accordion>

  <Accordion title="Rotate keys periodically">
    Create new API keys and revoke old ones regularly for security.
  </Accordion>

  <Accordion title="Use minimal scopes">
    Only request the scopes your application needs.
  </Accordion>

  <Accordion title="Monitor usage">
    Check the dashboard for API key usage and suspicious activity.
  </Accordion>
</AccordionGroup>

## Rate Limits

API requests are rate limited to ensure fair usage:

| Plan       | Requests/minute | Requests/day |
| ---------- | --------------- | ------------ |
| Free       | 60              | 1,000        |
| Pro        | 300             | 10,000       |
| Enterprise | Custom          | Custom       |

When rate limited, you'll receive:

```json theme={null}
{
  "error": {
    "code": 429,
    "message": "Rate limit exceeded",
    "retryAfter": 60
  }
}
```