# Authentication

Every request carries a secret API key as a bearer token over HTTPS. Requests without a valid key
return `401` with `error.type: authentication_error`.

```
Authorization: Bearer sk_live_7f3a91c04d8e2b6a5c1f
SciSpace-Version: 2026-08-01
```

## One kind of key: secret, server-side

| | |
|---|---|
| Live | `sk_live_…` — billed against your organization's credits |
| Test | `sk_test_…` — 500 free credits a month, see environments |

There is **no publishable or browser-safe key**. Every endpoint is metered and returns licensed
scholarly content, so all calls must originate from your backend.

> [!danger] Never ship a key to a client
> A key in a browser bundle, mobile binary, or public repository can drain your entire credit balance.
> Proxy API calls through your own server and apply your own per-user limits.

## Scopes

Keys are scoped. A call outside a key's scopes returns `403 permission_error` — it does not silently
degrade. Full list in teams-and-scopes; a new key defaults to full access minus `webhooks:write`
and `usage:read`.

## Verifying a key

```bash
curl https://api.scispace.com/v1/usage \
  -H "Authorization: Bearer $SCISPACE_API_KEY"
```

`200` means the key is live and has `usage:read`. `401` means the key is wrong or revoked; `403` means
it is valid but unscoped for that call.

## Related

api-keys · environments · teams-and-scopes · errors-and-retries