---
title: API authentication
sidebar_label: Authentication
sidebar_position: 3
description: Authenticate with a bearer token. Key format and scope, the one endpoint that needs no key, what to do if a key leaks, and how sessions differ from keys.
keywords: [api authentication, bearer token, api key, authorization header, key rotation]
---

# Authentication

Send your key as a bearer token:

```
Authorization: Bearer esk_live_1a2b3c4d_9xKp2mQ7vR4tY8wA1sD5fG3hJ6kL0nB4cX7zM9qE2rT
```

That is the whole scheme. There is no signature, no timestamp, no HMAC — the
API is read-only, served over TLS, and a signing scheme would add ceremony
without adding protection.

## One exception

`GET /public-api/v1/openapi.json` needs **no key**. An automated client has to
be able to learn what it may call *without already having a key*, or discovery
is circular — and a circular discovery story is exactly what produces the
scrapers this API exists to redirect.

## Keys

- Up to **ten live keys** per account. Use one per deployment, so revoking a
  leaked key does not take everything else down with it.
- **Rotation** issues a replacement and leaves the old key working for **24
  hours**. An instant swap breaks every deployment using the old key the moment
  you click rotate, which is how people learn not to rotate.
- **Revocation is instant.** Not "within a minute" — the next request with that
  key is refused.

## If a key leaks

Revoke it. Then look at your [ledger](https://app.electroswap.io/developer) —
every credit ever granted or spent on your account is itemised there, so you can
see exactly what the leak cost.

## Sessions

The developer console signs you in with a wallet signature and issues an opaque
session token. It is not a JWT: revocation has to be immediate, and a JWT would
have meant a signing secret to manage plus a revocation list to check, which is
a session table with extra steps.

Sessions last 24 hours. "Sign out everywhere" ends all of them at once.