> ## Documentation Index
> Fetch the complete documentation index at: https://iotools.cloud/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Bearer API keys — how to create, use and revoke them

Every request carries an API key as a Bearer token.

```bash theme={"system"}
curl https://api.iotools.cloud/v1/tools/list \
  -H "Authorization: Bearer YOUR_API_KEY"
```

## Getting a key

1. Sign in to [IOTools.cloud](https://iotools.cloud/sign-in/)
2. Go to [Account → API keys](https://iotools.cloud/account/#api-keys)
3. **Create key**, give it a name you'll recognise later
4. Copy it

<Warning>
  The full key is shown **once**, at creation. We store only a hash, so we cannot show it to you again or recover it. Revoke and mint a new one if you lose it.
</Warning>

You can hold up to **10 active keys** at a time. Name them per environment or per integration, so revoking one affects only that integration.

## Key format

| Prefix      | Meaning                                       |
| ----------- | --------------------------------------------- |
| `iot_live_` | The only kind — there is no separate test key |

<Note>
  For testing, point at a zero-weight tool such as `case-converter` or `base64-decode` — you will be charged your plan's minimum per call — and read `credits_remaining` on the response to see what you spent.
</Note>

## Storing it

```bash theme={"system"}
# .env — never commit this
IOTOOLS_API_KEY=iot_live_your_key_here
```

```javascript theme={"system"}
const key = process.env.IOTOOLS_API_KEY;
```

**Keys belong on your server.** A key in client-side JavaScript is readable by anyone, who can then spend your credits. To use a tool from a browser, proxy the request through your own backend.

## Revoking

[Account → API keys](https://iotools.cloud/account/#api-keys) → **Revoke**. It takes effect on the next request; there is no cache to wait out. Revoked keys stay in the list rather than disappearing, so you keep the record.

## Auth errors

Every failure is an [RFC 9457 problem document](/docs/concepts/errors).

| Status | `code`             | Meaning                                                    |
| ------ | ------------------ | ---------------------------------------------------------- |
| 401    | `invalid_api_key`  | Missing, malformed or revoked key                          |
| 503    | `api_unconfigured` | Our fault, not yours — the service is misconfigured. Retry |

```json theme={"system"}
{
  "type": "https://iotools.cloud/docs/errors/invalid_api_key",
  "title": "Invalid API key",
  "status": 401,
  "code": "invalid_api_key",
  "detail": "Provide 'Authorization: Bearer <key>'.",
  "request_id": "e4042b29-…"
}
```