# Authentication

> API keys and how to keep them safe.

Every request sends `Authorization: Bearer eroq_sk_…` — keys are created in the dashboard (https://eroq.ai/dashboard/keys).

- Server-side only: never ship a key in browser or mobile code; proxy through your backend.
- One key per surface (up to 10, free) — staging and production rotate independently.
- Revocation is immediate; usage history stays in the ledger.
- Only a SHA-256 hash is stored — a lost key cannot be re-shown, mint a replacement.

---
Canonical: https://eroq.ai/docs/authentication · Index for agents: https://eroq.ai/llms.txt · OpenAPI: https://eroq.ai/openapi.json