# Authentication

> One header on every call.

Source: https://docs.nocamclub.com/authentication

Send your key on every call:

```http
Authorization: Bearer nc_live_abc123…
```

`GET /v1/models`, `GET /v1/models/{id}` and `GET /v1/openapi.json` are open and need no key.

## Two kinds of key

| Starts with | What it does |
|---|---|
| `nc_live_` | Runs real models and spends credits |
| `nc_test_` | The [sandbox](https://docs.nocamclub.com/sandbox.md): sample results, no credits |

## What a key can be limited to

Whoever makes the key can set:

| Limit | What happens past it |
|---|---|
| Permissions (`models:read`, `generations:read`, `generations:write`, `uploads:write`, `account:read`) | [`missing_scope`](https://docs.nocamclub.com/errors/missing_scope.md) |
| A spend limit per day, week, month or in total | [`spend_limit_reached`](https://docs.nocamclub.com/errors/spend_limit_reached.md) |
| A list of models | [`model_not_allowed`](https://docs.nocamclub.com/errors/model_not_allowed.md) |
| A list of addresses | [`ip_not_allowed`](https://docs.nocamclub.com/errors/ip_not_allowed.md) |
| An expiry date | [`expired_api_key`](https://docs.nocamclub.com/errors/expired_api_key.md) |

Give an AI agent its own key with a spend limit. If it goes wrong, the damage has a ceiling, and you can revoke that key alone.

## Keeping it safe

- Keep it in an environment variable, never in code or in a chat.
- A browser page can't keep a secret: call the API from your server.
- A key's fixed prefix lets secret scanners spot a leak. If one leaks, have it revoked: it stops working at once.

We store only a keyed hash of each key, so a lost key can't be shown again. You get a new one.