> ## Documentation Index
> Fetch the complete documentation index at: https://docs.haau3.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How haau3 platform API keys work, and the 401 contract.

Every request to a versioned endpoint (`/v1/...`) must include a valid API key. Keys are
free; create one in the [dashboard](https://platform.haau3.com).

## API keys

* Keys are **organization-scoped** and look like `haau3_sk_…`.
* A key's secret is shown **once** at creation. Store it securely. If it's lost, revoke it
  and create a new one.
* Keys are stored hashed at rest, so haau3 cannot recover a secret after it's shown.

## Sending your key

Send the key as a Bearer token in the `Authorization` header:

```bash theme={null}
curl -s https://api.haau3.com/v1/scheduling/slots \
  -H "Authorization: Bearer haau3_sk_your_key_here"
```

<Note>
  The `x-api-key: haau3_sk_…` header is also accepted in place of `Authorization: Bearer`.
</Note>

## The 401 contract

A missing or invalid key returns `401 Unauthorized`:

```json theme={null}
{
  "error": "API key required",
  "message": "Create a free key in the dashboard. See https://platform.haau3.com/docs"
}
```

A valid key returns `200`. There are no rate limits or usage charges today, and a free key
grants full access. Paid tiers and usage limits are planned, and they'll be documented here
before they take effect.

## Keeping keys safe

<Warning>
  Treat API keys like passwords. Don't commit them to source control or expose them in
  client-side code. Use server-side requests or a secrets manager, and revoke any key you
  believe is compromised.
</Warning>