> ## Documentation Index
> Fetch the complete documentation index at: https://docs.framelane.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> All API requests require a Bearer API key.

## API keys

All requests to `api.framelane.io/v1/*` must include an `Authorization` header:

```http theme={null}
Authorization: Bearer fl_live_kT9uQw...
```

You can create and manage API keys in the [console](https://console.framelane.io) under **Settings → API Keys**.

Agents can provision a key **without a human or a browser** via `POST /v1/signup` → `POST /v1/signup/verify` (the returned key is gated until the emailed OTP is verified). See [Self-provisioning for agents](/introduction/self-provisioning).

<Warning>
  API keys are shown only once at creation time. Store them in a secret manager (e.g. AWS Secrets Manager, GCP Secret Manager, or a `.env` file excluded from version control).
</Warning>

## Scopes

All API keys have full workspace access. Scoped keys with read-only or task-specific access are on the roadmap.

## Rotating keys

1. Create a new key in the console.
2. Update your application to use the new key.
3. Revoke the old key via `DELETE /v1/api-keys/{key_id}`.

## Error responses

An invalid or missing API key returns:

```json theme={null}
{
  "error": {
    "code": "unauthorized",
    "message": "Missing Authorization header."
  }
}
```

Status code: **401 Unauthorized**.