# Authentication

Authenticate IronDome API requests with a Bearer key. Create, store and revoke server-side keys, and keep credentials out of browser code.

Authenticate requests to `https://api.irondome.dev` with the full API key issued by your IronDome account.

## Create and store a key

Open [API keys](https://app.irondome.dev/keys), create a key, and copy it when shown. Store it in your server's secret manager or an ignored environment file as `IRONDOME_API_KEY`.

Treat credentials as opaque. Do not construct them, change their prefixes, or infer permissions from their appearance. Manage access through your account.

## Plan changes

New keys use the unified account-key format. Keep the same key and `https://api.irondome.dev` when upgrading or downgrading your plan. The server applies the account's current plan after policy publication; a plan change does not require recreating your SDK client.

Rotate a key when replacing a credential, not for an ordinary plan change. Existing legacy keys need a one-time replacement; see [migration](/docs/guides/migrate#replace-a-legacy-key).

## Send the credential

```http
Authorization: Bearer YOUR_API_KEY
```

Use this header on `/v1/check`, `/v1/check/bulk`, and `/v1/usage`. The [health endpoint](/docs/api/health) needs no credential. Do not send keys in query strings or request bodies.

The service checks credentials, permissions, and account policy. HTTP `401` means authentication failed; HTTP `403` means the operation is not permitted. See [errors](/docs/errors).

## Rotate a key

1. Create a replacement in the dashboard and save it securely.
2. Update every server or deployment environment using the credential.
3. Recreate long-lived clients so they read the replacement. Drain in-flight work before closing their pools.
4. Confirm a controlled check succeeds. This check consumes usage.
5. Revoke the replaced key and check its dashboard status.

Revocation can remain pending during policy publication. Do not assume immediate global revocation. Revoke an exposed key promptly and replace it wherever it was deployed.

## Browser and platform applications

Your browser should call your own protected backend. Validate inputs and apply rate limits before calling IronDome. An unrestricted proxy can consume your allowance.

Keep credentials out of browser bundles, frontend environment variables, analytics, and logs. A Supabase installation uses a separate [hook signing secret](/docs/guides/supabase#rotate-the-signing-secret); do not put an API key in the hook secret field.