> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rankraft.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create an organization API key and send it with every request.

## Create a key

An **owner** of your organization creates keys in the dashboard under **Settings → API & AI assistants**:

1. Name the key after what will use it, e.g. *Data warehouse sync*.
2. Choose when it expires: 30, 90 or 180 days, or one year. Every key expires.
3. Choose its access:
   * **Read only** — every read endpoint.
   * **Read and manage prompts** — also create, edit and switch prompts on or off.
4. Click **Create key** and copy it. It looks like `rr_api_…`.

> [!WARNING]
>
> The key is shown **once**. RankRaft keeps only a fingerprint of it, so it cannot be shown again. If you lose it, revoke it and create another.

Every member of the organization can see the list of keys — their names, who created them, when they expire and when they were last used — but never the keys themselves. Only owners create and revoke.

## Send the key

Put it in the `X-API-Key` header:

```bash theme={"system"}
curl https://api.rankraft.ai/v1/me -H "X-API-Key: rr_api_…"
```

`Authorization: Bearer rr_api_…` works too.

> [!WARNING]
>
> Never put a key in a URL. A request with a key in its query string is refused with `400 api_key_in_url` — by then the key may already be in proxy and browser logs, so revoke it. Never use a key in browser code: the API sends no CORS headers, on purpose.

## What a key can reach

A key belongs to your **organization** and reads every site in it. It cannot reach another organization's data: a site id from another account answers `404`, exactly as if it did not exist.

## When a key stops working

| Situation | Response |
| - | - |
| Missing, malformed, unknown, revoked or expired key | `401 invalid_api_key` — one message for all of them |
| Your organization is not on a live Enterprise plan | `403 plan_required` |

API keys work with the REST API only. AI assistants connect to the [MCP server](/mcp/introduction) by signing in instead. | A read-only key calls a write endpoint | `403 insufficient_permission` |

Revoking a key in the dashboard takes effect on the very next request. A downgrade or a lapsed payment cuts API access at once, not when the key expires.

## Check a key

[`GET /v1/me`](/api-reference/endpoints/get-me) returns the key's name, access, expiry and organization — a good connection test.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.