> ## Documentation Index
> Fetch the complete documentation index at: https://docs.panoqore.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, scopes and what a key can reach.

Send your key as a bearer token on every call.

```bash theme={null}
curl "$PANOQORE_URL/v1/me" -H "Authorization: Bearer $PANOQORE_API_KEY"
```

```json theme={null}
{
  "id": "key_01M6F1ABHKF2BTA49QYK5MQPSF",
  "scopes": ["read", "entries:write", "holds:write", "named:write"],
  "tenantId": "tnt_01M6F1ABHKF2K8GS124ZZBR194",
  "tenantSlug": "acme",
  "environment": "sandbox"
}
```

A missing, wrong, revoked or expired key gets `401 UNAUTHENTICATED`, and the answer does not say which. So does a key used from a network it is not allowed on.

## Getting a key

A tenant admin creates keys in the console. The secret is shown once and only a hash is stored. A key looks like `pk_<live|test>_<id>_<secret>`.

A live key with any write scope needs approval before it works, and whoever asked for it collects the secret afterwards. Managing keys is console work: it needs the `manage` scope, which no key can hold.

## Scopes

| Scope | Allows |
| - | - |
| `read` | Reading. |
| `entries:write` | Accounts, entries, reversals, lending events, FX conversions. Also reads most of what it writes. |
| `holds:write` | Holds: create, capture, release, read. |
| `named:write` | Binding named accounts and recording inbound credits. |
| `fx:write` | Getting FX quotes. A conversion needs `entries:write`. |
| `recon:write` | Sending statements and running a match. |
| `webhooks:manage` | Webhook endpoints. |

Each page in the [API reference](https://docs.panoqore.com/api-reference/overview.md) names the scopes it accepts. Calling without one gets `403 MISSING_SCOPE`, and `error.details.scope` names what is needed.

`payments:write` can be set on a key, but nothing uses it yet.

## What a key cannot do

Keys post directly. They never propose or approve. These always need a person: approving or rejecting a request, freezing an account, changing an overdraft limit, closing a period, setting fee schedules and FX rates, and switching account modules on.

The one exception is a loan write-off: a key can ask for one, and a person must approve it. See [Lending](https://docs.panoqore.com/guides/lending.md).

## Rotation and revocation

Rotating a key gives you a new secret and the old one keeps working for an overlap, so you can deploy without a gap. A revoked key can keep working for up to 60 seconds, because verified keys are cached that long.

## Keep keys on your server

Keys are not for browsers or mobile apps. Browser calls are allowed only from configured origins, which is the console.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.