# Authentication

Every request needs an API key. Send it in the `Authorization` header:

```http
Authorization: Bearer vq_live_abc123def456_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
```

If your HTTP client makes custom `Authorization` headers awkward, you can send the same key as `X-API-Key: vq_live_...` instead.

## Creating keys

Create keys in the dashboard under [API keys](https://veqen-app.com/app/keys). Give each one a name you'll recognise later, like "Production signup" or "Staging".

- **A key is shown once.** We store only a fingerprint of it, so we can't show it again. If you lose it, create a new one and revoke the old one.
- **You can have up to 20 active keys.** Use one per app or environment, so you can revoke one without breaking the others.
- **All keys on an account share one credit balance.**

## Keeping keys safe

- Call the API **from your server**, never from a browser or mobile app. Anyone can read a key that ships in client-side code.
- Keep keys in environment variables or a secrets manager, not in your repository.
- If a key leaks, [revoke it](https://veqen-app.com/app/keys) right away. Revoked keys stop working instantly.

## Errors

| HTTP | `error.type` | What happened | Fix |
|---|---|---|---|
| 401 | `missing_api_key` | No key in the request. | Add `Authorization: Bearer vq_live_...`. |
| 401 | `invalid_api_key` | The key is malformed, unknown or revoked. | Copy the key again, or create a new one. |
| 403 | `account_suspended` | The account is suspended. | [Contact us](https://veqen-app.com/contact). |

## AI agents and OAuth

MCP clients such as Claude can connect with OAuth instead of a key: you sign in and approve access, and no key is copied anywhere. See [MCP server](/docs/mcp).