# Authentication and API keys

Portal sign-in identifies you in the dashboard. API keys authenticate requests from your applications. Your portal password or browser token is not an application API key.

Send your The-Code key in the HTTP header:

```http
Authorization: Bearer <THE_CODE_API_KEY>
```

## Create and manage keys

Open [API keys](https://thecodeapi.com/dashboard?tab=keys) after signing in. Give each application or environment a descriptive key name. Copy a newly created key when shown and keep it in a server-side environment variable or secret manager.

Suspend a key to stop its use temporarily. Resume a suspended key when appropriate; an expired key cannot be resumed. Delete a key to revoke it permanently. To rotate a credential, create a replacement, update the application, verify the replacement, then delete the old key.

The gateway checks key status and expiry together with account, model, and credit policies. Having a key does not grant access to every upstream model.

## Keep credentials private

Never put API keys in frontend JavaScript, URLs, repositories, screenshots, logs, or agent setup prompts. Applications send The-Code keys, not upstream provider credentials. If a key is exposed, revoke it and create a replacement.

Contact [Support@the-code.org](mailto:Support@the-code.org) for account-access help. Do not email passwords or API keys.