> ## Documentation Index
> Fetch the complete documentation index at: https://highseat.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create an API key in workspace settings, choose the sites it reads, and send it as a bearer token.

Every call carries an API key in the `Authorization` header. A key starts with `hs_live_`.

```bash theme={null}
curl https://api.highseat.com/v1/key \
  -H "Authorization: Bearer hs_live_…"
```

## Create a key

In the dashboard, open **Workspace settings › API keys** and choose **New API key**. Name the key after whatever will use it, then pick the sites it reads:

* **Every site, sites added later included**
* **Only the sites I pick**

The dashboard shows the key once. Copy it before you close the dialog.

A key belongs to its workspace, not to the member who created it, so it keeps working after that member leaves. [Describe the API key](/docs/api/key/describe-the-api-key) returns the workspace and the sites a key reads.

## Keep the key secret

A key reads your stats, so keep it on a server or in a script's environment, never in a web page. The site id in your tracker snippet is public, and the API never accepts it in place of a key.

## Delete a key

Delete a key in **Workspace settings › API keys**. A call made with it then answers `401` with the code `UNAUTHORIZED`, as a call with no key does.

A workspace whose reports are closed until it pays keeps its keys. Their calls answer `403` with the code `FORBIDDEN` until the workspace pays again, except [Get the event usage](/docs/api/usage/get-the-event-usage), which keeps answering.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.