> ## Documentation Index
> Fetch the complete documentation index at: https://docs.outbound.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, what each key may call, and capping what a key spends.

Every request carries an API key as a Bearer token:

```bash theme={null}
curl https://api.outbound.dev/v1/me \
  -H "Authorization: Bearer ob_live_..."
```

`GET /v1/me` answers which key is calling, for which organization, and what it spent today. It is free, so it is a good first call.

## API keys

Create keys in the console, under **API keys**. A key is `ob_live_` followed by 32 random characters and a 6-character checksum.

* **It is shown once.** Copy it when you create it. Afterwards the console shows it masked, as `ob_live_7Kx2…34hx`.
* **It belongs to the organization**, not to the person who made it, so a teammate leaving never breaks an integration.
* **Every call counts against the organization's** balance and rate limits, whichever key makes it.

> [!WARNING]
>
> Treat a key like a password. Never commit it, put it in client-side code or paste it in a ticket. If a key leaks, revoke it: in the console, or with `POST /v1/me/revoke` called with that key. Revoking takes effect on the key's next call.

## Scopes

A key's scope decides what it may call.

| Scope | What the key may call |
| - | - |
| **Full access** | Everything. |
| **Read only** | Every call that changes nothing: searches, counts, filter values, reading and running saved searches, and your account. It cannot create, change or delete a saved search. |
| **Products** | The calls of the products you pick, such as **search**, plus your account. |

Every key can read its own account: `GET /v1/me`, the balance, prices, rate limits, its own usage and requests, and jobs. Reading the organization's ledger (`GET /v1/wallet/transactions`), and another key's usage or requests, needs a key with full access.

A call outside the key's scope answers `403` with `insufficient_scope`.

## Daily spending caps

A key can have a daily spending cap, set in the console. A paid call that would take the key past its cap for the day answers `402` with `key_daily_cap_reached`, and nothing runs. Caps reset at midnight UTC. `GET /v1/me` and `GET /v1/limits` show what the key spent today and what is left of its cap.

## Expiry

A key can be created with an expiry date. After it, calls answer `401` with `api_key_expired`.

## When a key is refused

| Status | Code | Meaning |
| - | - | - |
| `401` | `api_key_missing` | No key was sent. Send `Authorization: Bearer <key>`. |
| `401` | `api_key_invalid` | The key is malformed, its checksum is wrong, or no such key exists. Check that it was copied in full. |
| `401` | `api_key_revoked` | The key was revoked. Create a new one. |
| `401` | `api_key_expired` | The key expired. Create a new one. |
| `403` | `org_closed` | The key's organization is closed. |
| `403` | `insufficient_scope` | The key's scope does not allow this call. |

Calls without a valid key are rate limited by IP address, so a misconfigured client gets `429` once it keeps retrying.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.