> ## Documentation Index
> Fetch the complete documentation index at: https://docs.graphy.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

<Note>Don't have an API key yet? [Create one in the Graphy console](https://agents.graphy.dev/console/) — see [API keys](/agents/api-keys) for the full walkthrough.</Note>

## Base URL

```
https://agents.graphy.dev
```

## Authorization Header

```
Authorization: Bearer YOUR_API_KEY
```

## Required Headers

| Header | Value | Required |
| - | - | - |
| `Content-Type` | `application/json` | Yes |
| `Authorization` | `Bearer YOUR_API_KEY` | Yes, unless you are using [keyless access](/agents/rest/keyless) |

<Tip>Want to try the API before signing up? [Keyless access](/agents/rest/keyless) issues you a token on your first call, with a smaller budget.</Tip>

## Example call

```bash theme={null}
curl -N https://agents.graphy.dev/api/v0/generate \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{
    "config": {
      "type": "column",
      "data": {
        "columns": [
          { "key": "quarter", "label": "Quarter" },
          { "key": "revenue", "label": "Revenue ($)" }
        ],
        "rows": [
          { "quarter": "Q1", "revenue": 50000 },
          { "quarter": "Q2", "revenue": 62000 },
          { "quarter": "Q3", "revenue": 58000 },
          { "quarter": "Q4", "revenue": 71000 }
        ]
      }
    },
    "userPrompt": "Change to a line chart"
  }'
```

***

## API Key Security

<Warning>Never expose API keys in client-side code. Call the API from your backend.</Warning>

**Best practices:**

* Store keys in environment variables
* Use a secrets manager in production
* Rotate keys periodically
* Use separate keys for development and production

***

## Authentication Errors

| Status | Error | Description |
| - | - | - |
| 401 | `AUTHENTICATION_ERROR` | Missing or invalid API key |
| 403 | `AUTHORIZATION_ERROR` | Key lacks required permissions |

Authentication errors are not retryable. Check that:

* The `Authorization` header is present
* The header format is `Bearer YOUR_API_KEY` (note the space)
* The API key is valid and active


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.