> ## Documentation Index
> Fetch the complete documentation index at: https://docs.klara-ai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Learn how to authenticate with the Klara API using API keys

The Klara API uses API keys for authentication. Each key is scoped to your organization and can be managed from your dashboard.

<Note>
  **Sandbox vs Production:** API keys are environment-specific. Generate sandbox keys from [sandbox.klara-ai.com](https://sandbox.klara-ai.com) and production keys from [app.klara-ai.com](https://app.klara-ai.com). Keys from one environment do not work in the other.
</Note>

## API key format

API keys consist of two parts separated by a period:

```
klara_{client_id}.{secret}
```

| Component   | Description                             |
| ----------- | --------------------------------------- |
| `klara_`    | Fixed prefix identifying Klara API keys |
| `client_id` | 24-character hex identifier             |
| `secret`    | 32-character base64url-encoded secret   |

## Using your API key

Include your API key in the `Authorization` header of every request:

```bash theme={null}
Authorization: Bearer klara_abc123def456789012345678.ABCDEFghijklmnop1234567890QRSTUV
```

<Warning>
  Never expose your API key in client-side code, public repositories, or logs.
</Warning>

## Managing API keys

### Creating a key

1. Go to **Settings → Integrations → API Keys** in your Klara dashboard
2. Click **Create API Key**
3. Enter a descriptive name
4. Copy the full key immediately—the secret is only shown once

### Revoking a key

1. Go to **Settings → Integrations → API Keys**
2. Find the key you want to revoke
3. Click **Revoke** and confirm

Revoked keys stop working immediately.

## Scopes

API keys are created with scopes that determine what actions they can perform:

| Scope                 | Description                                          |
| --------------------- | ---------------------------------------------------- |
| `applications:create` | Create new applications, refresh pre-auth codes      |
| `applications:read`   | List and read applications, download documents       |
| `applications:write`  | Update application fields, record provider decisions |

## Error responses

Authentication failures return a `401 Unauthorized` response:

```json theme={null}
{
  "error": "unauthorized",
  "message": "Invalid or expired API key"
}
```