> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.slotflow.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.slotflow.dev/_mcp/server.

# Authentication

> How to authenticate with the Slotflow API using your API key.

All Slotflow API requests require authentication via an API key passed as a Bearer token in the `Authorization` header.

## API key format

Slotflow API keys use the `sk_live_` prefix followed by a random string:

```
sk_live_your_api_key
```

## Making authenticated requests

Include your API key in the `Authorization` header of every request:

```bash
curl https://api.slotflow.dev/v1/humans \
  -H "Authorization: Bearer sk_live_your_api_key"
```

```javascript
const response = await fetch("https://api.slotflow.dev/v1/humans", {
  headers: {
    "Authorization": "Bearer sk_live_your_api_key",
  },
});
```

```python
response = requests.get(
    "https://api.slotflow.dev/v1/humans",
    headers={"Authorization": "Bearer sk_live_your_api_key"},
)
```

## Getting your API key

1. Sign in to the [Slotflow Dashboard](https://app.slotflow.dev)
2. Your API key is displayed on the **Overview** page
3. Click the eye icon to reveal the full key, then copy it

## One key per organization

Each Slotflow organization has a single API key. All humans, bookings, and webhooks created with that key are scoped to your organization. There is no way for one API key to access another organization's data.

## Regenerating your key

If your API key is compromised:

1. Go to the [Dashboard Overview](https://app.slotflow.dev)
2. Click **Regenerate API Key**
3. Confirm the action (this is destructive)

The old key is invalidated immediately. Any requests using the old key will receive a `401 UNAUTHORIZED` error. Update your agent's configuration with the new key right away.

## Error response

Requests without a valid API key receive:

```json
{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Missing or invalid API key.",
    "status": 401
  }
}
```

## Security best practices

* **Never hardcode API keys in source code.** Use environment variables instead.
* **Never commit keys to version control.** Add `.env` files to `.gitignore`.
* **Rotate keys if leaked.** Regenerate immediately from the dashboard if a key is exposed in a public repository, log file, or error message.
* **Use server-side only.** Never expose your API key in client-side code (browser JavaScript, mobile apps). All Slotflow API calls should be made from your backend.
* **One key, one environment.** Don't share a key between production and development environments.

```bash
# Good — environment variable
export SLOTFLOW_API_KEY="sk_live_your_api_key"
```

```javascript
// Good — read from environment
const apiKey = process.env.SLOTFLOW_API_KEY;

const response = await fetch("https://api.slotflow.dev/v1/humans", {
  headers: { "Authorization": `Bearer ${apiKey}` },
});
```