# Authentication

API keys, bearer tokens, and the 401 answer.


With the verify API, your own systems read and write the values your tags
carry. Every request sends an API key, and the key belongs to your team.

## Creating a key

Open **[API Keys](/dashboard/api-keys)** on the dashboard
and press **Create API Key**. Name the key after the system that will hold it,
"Warehouse sync" or "ERP", so you know which one to revoke later.

The key appears once, right after you create it. Copy it into your secret
store then. TAGBASE keeps only a hash and cannot show the key again. If you
lose it, create a new one.

A key has the rights of the whole team. A request with the key can read and
change every tag on every product the team owns, the same as a member on the
dashboard.

## Revoking a key

Press **Revoke** next to a key in the list. The key stops working at once,
and a request that still uses it gets a `401`. A team can hold more than one
key, so you can rotate while your integration keeps running: create the new
key, move your integration over, then revoke the old one.

## Sending the key

A key is two parts, a `key_` id and a secret, joined by a colon. Send the
whole string as a bearer token in the `Authorization` header:

```
Authorization: Bearer key_4vVevWu1Ettnd3dqiWUxY:eruD6LXiYaQd3WlwcJ-ZE1lSUiaclHUfeoyiH_J9tko
```

<!-- tabs -->
```bash cURL
curl https://verify.tagbase.io/api/tags \
  -H "Authorization: Bearer $TAGBASE_API_KEY" \
  -H "Accept: application/vnd.api+json"
```
```js
const res = await fetch("https://verify.tagbase.io/api/tags", {
  headers: {
    "Authorization": `Bearer ${process.env.TAGBASE_API_KEY}`,
    "Accept": "application/vnd.api+json",
  },
});
const { data, meta } = await res.json();
```
```php
$response = $client->get("https://verify.tagbase.io/api/tags", [
    "headers" => [
        "Authorization" => "Bearer " . getenv("TAGBASE_API_KEY"),
        "Accept"        => "application/vnd.api+json",
    ],
]);
$page = json_decode((string) $response->getBody(), true);
```
```elixir
page =
  Req.get!("https://verify.tagbase.io/api/tags",
    headers: [
      {"authorization", "Bearer #{System.fetch_env!("TAGBASE_API_KEY")}"},
      {"accept", "application/vnd.api+json"}
    ]
  ).body
```
<!-- /tabs -->

The API is server to server. Call it from your backend, never from a page in
a browser, where the key would be visible to anyone who opens the source.

## Auth errors

The API answers `401` to a request with no key, a malformed header, a wrong
secret, or a revoked key:

```json
{ "errors": [{ "status": "401", "title": "Unauthorized" }] }
```

The API does not say which of those it was. Check that the header reads
`Bearer ` followed by the whole key, `key_…:…`, and that the key is still
listed under **[API Keys](/dashboard/api-keys)**.

Next: read and write your tags with the [Tags](/docs/api/tags) endpoints.
The [API](/docs/api/introduction) page covers the base URL, errors, rate
limits, and pagination that every endpoint shares. The
[Products](/docs/api/products) and [Verifications](/docs/api/verifications)
endpoints cover the rest of the API.