# REST API authentication

An API key starts with `vmx_` and grants access to one workspace. Send it with every request in one of two ways.

## X-API-Key header

```http
X-API-Key: vmx_...
```

This is the primary and most explicit option.

## Bearer token

```http
Authorization: Bearer vmx_...
```

Both headers are accepted equally. Do not send them together.

## Storage and rotation

- keep the key in a secret manager or environment variable;
- create a separate key for each integration;
- review its last-used date in settings;
- delete it after a leak, ownership change, or integration shutdown.

Deletion revokes access immediately. A lost key cannot be recovered. Create a replacement and delete the old key.

Do not embed a key in browser JavaScript, a mobile application, or a public repository. Requests carrying the secret must originate from your server.

## Access errors

`401` means that the key is missing, invalid, expired, or revoked. `403` means the key is valid, but the user's workspace role does not allow the operation.