> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usecleff.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys: shape, environment scoping, and rotation.

Every `/v1/` endpoint authenticates with an **API key**, sent as a bearer token.

Getting your first key is a three-step path: sign up at
[app.usecleff.com/signup](https://app.usecleff.com/signup) (or register a Business with
[`POST /v1/registration`](/api-reference/registration)), verify the email address you
registered with, then sign in to the dashboard and create a key under
**Settings → API keys**. Registration itself returns no key; issuance is gated on
email verification.

## API key

Send the key in the `Authorization` header:

```http theme={null}
Authorization: Bearer ck_sandbox_a3f9bc12_<secret>
```

## Key shape

`ck_<environment>_<id_prefix>_<secret>`

* `environment`: `sandbox` or `production`
* `id_prefix`: 8 hex chars, public-safe identifier shown in dashboards
* `secret`: random, never stored in plaintext (HMAC-SHA256 verifier only, per ADR-0008)

The key binds both the Business and the environment it was issued for: a sandbox key
cannot read or modify production data, and a key issued to one Business can never reach
another's. Cross-tenant and cross-environment reads return `404`; the row is simply not
visible to the key.

## Rotation

The plaintext key is returned **exactly once** at creation time; store it when you
receive it, because Cleff keeps only a verifier and cannot show it to you again. If you
lose a key, rotate it from the dashboard: rotation issues a new key and revokes the old
one immediately.