> ## Documentation Index
> Fetch the complete documentation index at: https://developers.nlpearl.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API Secret Key

> Authenticate your own backend code with one key: your Account ID and a secret key, sent as a bearer token.

<Note>
  Handing access to someone else? An **OAuth 2.0 app** has its own client ID and
  secret, reaches only the scopes you grant it, and can be rotated on its own -
  see [OAuth 2.0](/api-reference/oauth).
</Note>

## Overview

An API secret key is the simplest way to call the NLPearl API: one key, created in your workspace settings, sent on every request. It carries **full access** to the workspace, which makes it the right credential for code you own and run yourself, and the wrong one to give to a third party.

<Info>
  API keys live on the **API Access** page of your workspace settings. Creating
  one requires an active subscription.
</Info>

***

## Creating an API Key

<Steps>
  <Step title="Open the API Access page">
    Click your **profile card** at the bottom-left corner of the sidebar, open **Settings**, then select **API Access** in the settings menu. You can also go there directly: [platform.nlpearl.ai/app/settings/api](https://platform.nlpearl.ai/app/settings/api).
  </Step>

  <Step title="Open Add API Key">
    Click **Create API Key**. The window that opens holds a **Name** and the
    **Secret Key** itself.
  </Step>

  <Step title="Name it and copy the key">
    Give it a name that identifies where the key will be used - up to 15
    characters - then copy the secret key with the button at the end of the field.
  </Step>

  <Step title="Create the key">
    Click **Create Key**. The key appears in the credentials list, marked with a key glyph and showing its first characters.
  </Step>
</Steps>

You can copy a key again at any time with the **copy** button on its row, and the **delete** button revokes it immediately.

<Warning>
  A secret key carries **full access** to your workspace and cannot be
  restricted to part of it. Keep it server-side, never ship it in a browser, a
  mobile app or a public repository, and never share it with a third party -
  create an [OAuth 2.0 app](/api-reference/oauth) for that instead.
</Warning>

***

## Finding Your Account ID

The header carries two values: your Account ID and the secret key. The **Account ID** identifies your workspace and is on the **General Settings** page of your workspace settings, under that name. It is also shown, with a copy button, in the workspace switcher.

***

## Authorization Header

Send both values as a bearer token, separated by a colon:

```http theme={null}
Authorization: Bearer AccountId:SecretKey
```

For example:

```http theme={null}
Authorization: Bearer 66552698d60e456235eae520:tWPqr5EEZv2dxqutv58NsCg7NuqGc1tX
```

### Example request

```bash theme={null}
curl -X GET "https://api.nlpearl.ai/v2/Pearl" \
     -H "Authorization: Bearer 66552698d60e456235eae520:tWPqr5EEZv2dxqutv58NsCg7NuqGc1tX"
```

Replace `66552698d60e456235eae520` with your Account ID and `tWPqr5EEZv2dxqutv58NsCg7NuqGc1tX` with your secret key.

<Note>
  The key does not expire and there is no token to request first: send the same
  header on every call. Deleting the key on the API Access page is what ends its
  access.
</Note>

***

## Errors

| Status | Meaning                                                                                                                    |
| ------ | -------------------------------------------------------------------------------------------------------------------------- |
| `401`  | The `Authorization` header is missing or malformed, the Account ID and key do not belong together, or the key was deleted. |