# Authentication (/docs/api/authentication)



Every request needs an `Authorization: Bearer <key>` header. Keys look like `dm_live_<40 hex>` and are scoped to a single team.

Creating a key [#creating-a-key]

In the [API Keys dashboard](/dashboard/api-keys), click **New key** and give it a recognizable name (usually the environment or service that will use it). You will see the full key once in a dialog. After that, only the prefix is retrievable.

```
dm_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

Store the key in an environment variable, never in source control.

Sending the header [#sending-the-header]

```
Authorization: Bearer dm_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

Applies to every `POST /api/v1/*` endpoint.

Rotating and revoking [#rotating-and-revoking]

Clicking **Revoke** in the dashboard deactivates a key immediately. The next request with a revoked key returns `401`. To rotate, create a new key first, deploy it, then revoke the old one.

What keys see [#what-keys-see]

A key can only read and modify data that belongs to its creator's team. Cross-team access is impossible by construction.

* Only team owners and admins can create or revoke keys.
* Team members see a read-only view.
* Revoking is instant. There is no cache.

Permissions [#permissions]

All keys currently carry the same scope (`email_finder credits search_history`). Fine-grained per-key permissions are a planned addition.