# Authentication

Every data request needs an API key in the `x-api-key` header. There is no OAuth and no query-string key: header only, so keys do not end up in logs and browser history.

```bash
curl "https://api.onekey.dev/v1/account" -H "x-api-key: YOUR_API_KEY"
```

## Your keys

- Keys start with `ok_live_` (real usage) or `ok_test_`.
- A key is shown **once**, when you create it. Copy it then. We store only a hash, so we cannot show it again.
- Create, label and revoke keys in your [dashboard](https://onekey.dev/dashboard/keys). Revoke a key the moment you suspect a leak; it stops working immediately.
- 1,000 free credits cover the open-platform endpoints. Hard-to-reach platforms (X, TikTok, Instagram, Reddit, and others marked on their page) need a verified email and a purchased pack. All keys on an account share one balance.

## Keep it safe

- Call Onekey from your server, not from browser code. Anything in a browser bundle is public.
- Read the key from an environment variable. Do not commit it.
- Use one key per app so you can revoke one without breaking the rest.

## What happens with a bad key

You get `401 unauthorized`. Repeated bad attempts from one address are rate limited (`429`), so a loop that retries a wrong key will get slower, not faster. See [Errors](https://onekey.dev/docs/errors.md).