# Authentication

Company admins create an API access in mint under *Settings → API access*. Each access has its own scopes and keys.
A key is shown only once, right after it was created. Send it in the `Authorization` header:

```sh
curl -H "Authorization: Bearer mint_sk_live_…" https://api.cream-ai.de/api/v1/me
```

Keys in query strings are never accepted. `GET /me` shows the access, its company, scopes, key and limits.
Revoking a key or changing scopes in mint takes effect immediately.

The mint API must be enabled for your company by mint. Until then, or after it was disabled, every request with a
key of this company returns `403 api_not_enabled`; your accesses and keys are kept and work again once the API is
enabled.

### Keep keys secret

- Use the key only from your server. The API does not allow calls from browsers on other sites (no CORS).
- Do not put keys into source code, URLs, tickets or logs. Store them in a secret store or an environment variable.
- Each access can have up to two valid keys at the same time, so you can rotate a key without downtime: create the new
  key, deploy it, then revoke the old one.
- An access can be limited to IP addresses and can expire. `GET /me` shows `expires_at`.

```sh Authenticated request
curl https://api.cream-ai.de/api/v1/me \
  -H "Authorization: Bearer $MINT_API_KEY"
```

```json Missing or wrong key (401)
{
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid API key.",
    "request_id": "req_5b2e8f1a4c7d0e3b6a9f2c5d8e1b4a7c"
  }
}
```