# Authentication

Every request carries an API key. Keys belong to your organization.

The API authenticates with a secret key in the `Authorization` header of every request:

```bash
curl "https://geteem.com/api/v1/usage" \
  -H "Authorization: Bearer gtk_…"
```

A request without a valid key gets `401` with the error type `authentication_error`.

## Create a key

Open **API** in the navigation, go to **API Keys**, give the key a description — *Production*, *Staging*, the name of the integration — and click **Create Key**.

The key is shown **once**. Copy it into your secret store right away: we only keep a fingerprint of it, so nobody — including us — can show it to you again. Lost it? Delete it and create a new one.

Keys start with `gtk_`, so a key that ends up somewhere it shouldn't is easy to recognize.

## Who can manage keys

Owners and admins of your organization. A key works for the whole organization and uses its credits, which makes it an organization setting rather than a personal one. API access has to be part of your plan; if you don't see **API** in the navigation, get in touch.

## Keep keys secret

- Call the API from your **server**, never from a browser or mobile app: anything shipped to a client can be read.
- Don't commit keys to a repository; load them from an environment variable (`SIMBA_API_KEY` in the examples).
- Use **one key per integration**. The usage per key shows which integration spent what, and you can revoke one without touching the others.

## Revoke a key

Delete it under **API → API Keys**. It stops working immediately; calls with it get `401`. Its past usage stays visible under **Usage**.