# Authentication

> Every request carries a SuperHQ API key as a bearer token. Keys belong to one workspace.

Nanite uses SuperHQ API keys. Make one in the [console](https://app.superhq.ai) under **API keys**, and send it on every request:

```bash
curl https://api.nanite.run/v1/sandboxes -H "Authorization: Bearer sk_..."
```

A key is `sk_` followed by 32 letters and digits. The console shows it once, when you make it.

## Workspaces and organizations

A key belongs to one workspace, and it sees only the sandboxes of that workspace. The API calls a workspace an organization: the `organization` field of a sandbox is the id of the workspace that owns it. Credits and limits are per workspace too.

## Keeping keys safe

- Use keys from your server, never from a browser or from inside a sandbox.
- Give each service its own key, so you can revoke one without touching the others.
- Revoke a key in the console the moment you think it leaked.

To give an agent inside a sandbox access to an outside API, use a [secret](https://nanite.run/docs/environment-and-secrets.md#secrets), not your key.

## Refusals

| Status | Code                     | When                                                        |
| ------ | ------------------------ | ----------------------------------------------------------- |
| 401    | `unauthorized`           | The header is missing, malformed, or the key was revoked.   |
| 403    | `forbidden`              | The key has no access to sandboxes.                         |
| 403    | `organization_suspended` | The workspace is suspended. Write to support to restore it. |

A 401 also carries `WWW-Authenticate: Bearer`.

```json
{ "error": "unauthorized", "message": "missing or invalid API key" }
```