# Authentication
> Every request carries a SuperHQ API key as a bearer token. Keys belong to one workspace.
Nanite uses SuperHQ API keys. Make one in the [console](https://app.superhq.ai) under **API keys**, and send it on every request:
```bash
curl https://api.nanite.run/v1/sandboxes -H "Authorization: Bearer sk_..."
```
A key is `sk_` followed by 32 letters and digits. The console shows it once, when you make it.
## Workspaces and organizations
A key belongs to one workspace, and it sees only the sandboxes of that workspace. The API calls a workspace an organization: the `organization` field of a sandbox is the id of the workspace that owns it. Credits and limits are per workspace too.
## Keeping keys safe
- Use keys from your server, never from a browser or from inside a sandbox.
- Give each service its own key, so you can revoke one without touching the others.
- Revoke a key in the console the moment you think it leaked.
To give an agent inside a sandbox access to an outside API, use a [secret](https://nanite.run/docs/environment-and-secrets.md#secrets), not your key.
## Refusals
| Status | Code | When |
| ------ | ------------------------ | ----------------------------------------------------------- |
| 401 | `unauthorized` | The header is missing, malformed, or the key was revoked. |
| 403 | `forbidden` | The key has no access to sandboxes. |
| 403 | `organization_suspended` | The workspace is suspended. Write to support to restore it. |
A 401 also carries `WWW-Authenticate: Bearer`.
```json
{ "error": "unauthorized", "message": "missing or invalid API key" }
```
A key belongs to one workspace, and it sees only the sandboxes of that workspace. The API calls a workspace an organization: the organization field of a sandbox is the id of the workspace that owns it. Credits and limits are per workspace too.