> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kodisc.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, Bearer tokens, rotation, and revocation.

Every request to `/api/v2/*` is authenticated with an API key sent as an HTTP Bearer token.

```http theme={"system"}
Authorization: Bearer kdsc_live_<48 hex chars>
```

Requests without a valid `Authorization` header — or with a key that's been revoked — get a [`401 Unauthorized`](/errors#401-unauthorized).

## Key format

Kodisc API keys look like:

```
kdsc_live_9c1d3f2e8b6a4d7c0f5e2a1b8c4d7e9f6a3b1c0d8e5f2a4b
```

* Prefix `kdsc_live_` marks the key as a live API credential.
* The remaining 48 characters are random hex.
* The first 16 characters (e.g. `kdsc_live_9c1d`) are the **display prefix** — safe to log, show in your dashboard, and refer to in support tickets. The full key is **not** safe to log.

## Creating a key

1. Open the [developer dashboard](https://kodisc.com/developer/keys).
2. Click **New key**, name it something you'll recognize later (e.g. `prod-render-worker`).
3. Optionally set a **default webhook URL** — every job created with this key will deliver to that URL unless overridden per-request (see [Webhooks](/webhooks)).
4. Copy the full key. It is **shown exactly once**. If you lose it, revoke the key and issue a new one.

When you create a key, Kodisc also generates a **webhook signing secret** (`whsec_…`). It never appears in any API response and is unique to that key — see [verifying signatures](/webhooks#verifying-signatures).

<Warning>
  Store keys in a secret manager. Never commit them to git, ship them in a frontend bundle, or paste them into shared documents. The full plaintext is only retrievable at creation time — Kodisc only ever stores a SHA-256 hash.
</Warning>

## Using a key

Send the key in the `Authorization` header on every request:

<CodeGroup>
  ```bash curl theme={"system"}
  curl https://kodisc.com/api/v2/me \
    -H "Authorization: Bearer $KODISC_KEY"
  ```

  ```ts node theme={"system"}
  const res = await fetch("https://kodisc.com/api/v2/me", {
    headers: { Authorization: `Bearer ${process.env.KODISC_KEY}` },
  });
  const me = await res.json();
  ```

  ```python python theme={"system"}
  import os, requests

  res = requests.get(
      "https://kodisc.com/api/v2/me",
      headers={"Authorization": f"Bearer {os.environ['KODISC_KEY']}"},
  )
  me = res.json()
  ```
</CodeGroup>

Tip: hit [`GET /api/v2/me`](/api-reference/endpoint/get-me) right after wiring up auth — it confirms the key is valid and returns your live credit balance.

## Rotating the webhook secret

If you suspect your webhook signing secret has leaked, rotate it from the [developer dashboard](https://kodisc.com/developer/keys). The old secret is invalidated immediately; subsequent webhook deliveries are signed with the new one. The API key itself is unaffected.

## Revoking a key

Revoke any key from the [developer dashboard](https://kodisc.com/developer/keys). Revocation is immediate — the next request with that key returns `401`. There is no undo; create a new key if you change your mind.

Best practice: keep at least two keys in production (e.g. one per worker pool) so you can rotate without downtime.