> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pixcraft.es/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate with the PixCraft API using API keys.

# Authentication

All API endpoints (except `/api/v1/health`) require authentication using a Bearer token.

## Getting your API key

1. Sign up at [pixcraft.es](https://pixcraft.es)
2. Subscribe to an API plan at [pixcraft.es/developers](https://pixcraft.es/developers)
3. Navigate to [Dashboard → API Keys](https://pixcraft.es/dashboard/api)
4. Click **Create API Key**

Your key will look like: `px_live_a1b2c3d4e5f6...`

## Using your API key

Include the key in the `Authorization` header of every request:

```bash theme={null}
curl https://www.pixcraft.es/api/v1/capabilities \
  -H "Authorization: Bearer px_live_your_key_here"
```

## API key properties

Each API key has the following configuration:

| Property          | Description                                                   |
| ----------------- | ------------------------------------------------------------- |
| `plan`            | Starter, Business, or Enterprise                              |
| `allowed_domains` | CORS whitelist — requests from other domains are rejected     |
| `allowed_niches`  | Optional restriction — limit which niches this key can access |
| `custom_colors`   | Override the default color catalog for all niches             |
| `custom_logo_url` | Your logo for white-label PDF generation                      |

> **Note:** Monthly usage limits are tracked at the **account level**, not per key. All your API keys and widgets share the same monthly counter. See [Rate Limiting](/rate-limiting) for details.

## Error responses

| Scenario                  | HTTP Status | Error Code            |
| ------------------------- | ----------- | --------------------- |
| No `Authorization` header | 401         | `MISSING_API_KEY`     |
| Invalid or unknown key    | 401         | `INVALID_API_KEY`     |
| Key has been deactivated  | 401         | `INACTIVE_API_KEY`    |
| Monthly limit exceeded    | 429         | `RATE_LIMIT_EXCEEDED` |

Example error response:

```json theme={null}
{
  "error": true,
  "code": "INVALID_API_KEY",
  "message": "The provided API key is not valid.",
  "docs": "https://docs.pixcraft.es/errors/INVALID_API_KEY"
}
```

## Security best practices

* **Never expose your API key in client-side code** — always call the API from your backend
* **Use domain restrictions** — configure `allowed_domains` to limit where the key can be used
* **Rotate keys** — if a key is compromised, deactivate it and create a new one
* **Use separate keys** — create different keys for development, staging, and production