# Authentication

The Influtics API uses **Bearer Token authentication** with API keys. You'll need to include your API key in the `Authorization` header of every request.

## 🔑 Getting Your API Key

### 1. **Log in to Dashboard**
Visit [app.influtics.com](https://app.influtics.com) and sign in to your account.

### 2. **Navigate to Settings**
Go to **Settings** → **API** section in your dashboard.

### 3. **Generate API Key**
Click **"Generate New API Key"** to create your authentication token.

:::warning Keep Your API Key Secure
- Never expose your API key in client-side code
- Store it securely in environment variables
- Rotate keys regularly for security
:::

## 🔐 Authentication Format

Include your API key in the `Authorization` header using the Bearer token format:

```
Authorization: Bearer YOUR_API_KEY
```

## 📝 Example Requests

### cURL
```bash
curl -X GET https://api.influtics.com/v1/account/usage \
  -H "Authorization: Bearer your_api_key_here" \
  -H "Content-Type: application/json"
```

### JavaScript/Node.js
```javascript
const response = await fetch('https://api.influtics.com/v1/account/usage', {
  headers: {
    'Authorization': 'Bearer your_api_key_here',
    'Content-Type': 'application/json'
  }
});
```

### Python
```python
import requests

headers = {
    'Authorization': 'Bearer your_api_key_here',
    'Content-Type': 'application/json'
}

response = requests.get('https://api.influtics.com/v1/account/usage', headers=headers)
```

## ⚠️ Authentication Errors

All errors share the standard envelope `{ success: false, error: { code, message, request_id, ... } }`. The table below lists every documented `code` and the conditions that trigger it.

| Status | `code` | Trigger | Additional `error` fields |
|--------|--------|---------|---------------------------|
| `401` | `MISSING_AUTH` | No `Authorization: Bearer <key>` header on the request | — |
| `401` | `INVALID_API_KEY` | API key is empty, malformed, revoked, or does not match any active key in `api_keys` | — |
| `401` | `EXPIRED_API_KEY` | API key has passed its `expires_at` (rotated keys enter this state once `expires_at` elapses) | — |

## 🔄 API Key Management

### **Rotating Keys**
For security best practices:
1. Generate a new API key
2. Update your applications
3. Delete the old key after testing

### **Multiple Keys**
You can create multiple API keys for:
- Different environments (development, staging, production)
- Different applications
- Team member access

## 🛡️ Security Best Practices

### **Environment Variables**
Store your API key in environment variables:

```bash
# .env file
INFLUTICS_API_KEY=your_api_key_here
```

### **Server-Side Only**
Never include API keys in:
- Client-side JavaScript
- Mobile apps
- Public repositories
- Frontend code

### **HTTPS Only**
Always use HTTPS when making API requests to protect your API key in transit.

---

**Next Step**: [Track Your First Video →](./api/videos/track)