> ## Documentation Index
> Fetch the complete documentation index at: https://docs.graphy.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

<Note>Don't have an API key yet? [Create one in the Graphy console](https://agents.graphy.dev/console/) — see [API keys](/agents/api-keys) for the full walkthrough.</Note>

## Base URL

```
https://agents.graphy.dev
```

## Authorization Header

All requests require a Bearer token:

```
Authorization: Bearer YOUR_API_KEY
```

## Required Headers

| Header          | Value                 | Required |
| --------------- | --------------------- | -------- |
| `Content-Type`  | `application/json`    | Yes      |
| `Authorization` | `Bearer YOUR_API_KEY` | Yes      |

## Example call

```bash theme={null}
curl -N https://agents.graphy.dev/api/v0/generate \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{
    "config": {
      "type": "column",
      "data": {
        "columns": [
          { "key": "quarter", "label": "Quarter" },
          { "key": "revenue", "label": "Revenue ($)" }
        ],
        "rows": [
          { "quarter": "Q1", "revenue": 50000 },
          { "quarter": "Q2", "revenue": 62000 },
          { "quarter": "Q3", "revenue": 58000 },
          { "quarter": "Q4", "revenue": 71000 }
        ]
      }
    },
    "userPrompt": "Change to a line chart"
  }'
```

***

## API Key Security

<Warning>Never expose API keys in client-side code. Call the API from your backend.</Warning>

**Best practices:**

* Store keys in environment variables
* Use a secrets manager in production
* Rotate keys periodically
* Use separate keys for development and production

***

## Authentication Errors

| Status | Error                  | Description                    |
| ------ | ---------------------- | ------------------------------ |
| 401    | `AUTHENTICATION_ERROR` | Missing or invalid API key     |
| 403    | `AUTHORIZATION_ERROR`  | Key lacks required permissions |

Authentication errors are not retryable. Check that:

* The `Authorization` header is present
* The header format is `Bearer YOUR_API_KEY` (note the space)
* The API key is valid and active