---
title: "Authentication"
source: "https://docs.palt.io/authentication"
---

# Authentication

Every request carries an API key as a bearer token:

```
Authorization: Bearer pk_live_…
```

## Getting a key

- **In the dashboard:** Settings → API keys → Create key. The key is shown once; palt.io stores only a hash, so it cannot show it again.
- **From the CLI:** `palt login` opens your browser, you approve a short code, and the CLI receives a key named after your computer.

## What a key can do

A key acts as your account: everything you can do in the dashboard, on every project you own or belong to. Your role on each project still applies, so a key from an account with the viewer role on a project can read it but not change it.

Keep keys out of source control. In CI, store the key as a secret and expose it as `PALT_API_KEY`.

## Revoking a key

Delete it in Settings → API keys. It stops working immediately.

## Rate limits

Each key can make 600 requests a minute. Over that, requests are answered with `429` and the code `rate_limited`; wait a minute and retry.