> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truthfactor.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Account-scoped bearer keys, how they're minted, and what a 401 means.

Every call carries an account-scoped API key as a bearer token:

```http theme={null}
Authorization: Bearer tf_live_…
```

A missing, malformed, revoked or expired key all return an identical response:

```json theme={null}
{ "error": "invalid api key" }
```

with status `401`.

## How keys are minted

Keys are **minted directly from the dashboard by an admin of an active account**, and the raw
`tf_live_…` secret is shown **once**, in the creation response — store it somewhere safe at
that moment, because it is never shown again.

> [!WARNING]
>
> Approval gates the **account**, not each key. A new signup is `inactive` until a superadmin
> activates it, and an inactive account cannot mint keys at all. There is no per-key
> request-and-approval flow.

## Checking a key

`GET /v1/whoami` returns the account the key is bound to — a cheap way to confirm a key is
live and pointed at the right account before you wire up a batch:

```bash theme={null}
curl -sS https://api.truthfactor.ai/api/v1/whoami \
  -H "Authorization: Bearer $TF_API_KEY"
```

## Keep the secret server-side

The `tf_live_…` key authorizes spend against your account's credit balance. Treat it like any
other secret:

* Never ship it in client-side code, a mobile app, or a browser request.
* Store it in your secret manager or environment, not in source control.
* Rotate it from the dashboard if it may have leaked; a revoked key immediately returns `401`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.