> ## Documentation Index
> Fetch the complete documentation index at: https://docs.autosnap.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate requests to the AutosnapAI API

Every request to the AutosnapAI API is authenticated with an API key. You can pass the key in any of the following ways:

* **Body parameter** (POST/PATCH/DELETE): `"api_key": "as_live_..."`
* **Query parameter** (GET): `?api_key=as_live_...`
* **Authorization header**: `Authorization: Bearer as_live_...`
* **X-API-Key header**: `X-API-Key: as_live_...`

All methods are equivalent. Use whichever fits your architecture best.

```bash theme={null}
curl -X POST "https://api.autosnap.com/v1/dealers/resolve" \
  -H "Content-Type: application/json" \
  -d '{"api_key": "as_live_...", "dealership_url": "https://www.carlblackroswell.com"}'
```

For GET endpoints, pass the key as a query parameter:

```bash theme={null}
curl "https://api.autosnap.com/v1/dealers?api_key=as_live_..."
```

## API key format

Keys begin with one of two prefixes that make the key type obvious at a glance:

| Prefix     | Type         | Behavior                                                               |
| ---------- | ------------ | ---------------------------------------------------------------------- |
| `as_live_` | **Live key** | Production traffic. Subject to your account's rate limits.             |
| `as_test_` | **Test key** | Safe for development and CI. Subject to a separate monthly test quota. |

Both key types work against the same production database.

<Tip>
  **Use test keys in development.** Test quota overruns don't disrupt your live traffic.
</Tip>

## Creating and managing keys

Go to **Dashboard -> API Keys** at [ai.autosnap.com](https://ai.autosnap.com):

* **Create key** — generates a new key and shows it once. Copy immediately.
* **Deactivate** — disables a key. It can no longer be used for API requests.

You can have multiple live and test keys active at once.

## Securing keys

<Warning>
  **Never commit API keys to source control.** If a key is leaked, deactivate it immediately from the dashboard and create a new one.
</Warning>

* Store keys in environment variables or a secrets manager, not in code.
* Use **server-side calls only.** Never expose a live key in a browser, mobile app, or public client-side code.

## Response on invalid or missing keys

A missing API key and an invalid API key return different status codes:

| Scenario                                      | Status | Response                         |
| --------------------------------------------- | ------ | -------------------------------- |
| API key is missing from the request           | `401`  | `{"detail": "API key required"}` |
| API key is invalid, malformed, or deactivated | `403`  | `{"detail": "Invalid API key"}`  |

See [Errors](/get-started/errors) for the full error response format.

## Next steps

<Card title="Errors" icon="triangle-exclamation" href="/get-started/errors">
  Error response format and common error codes.
</Card>