> ## Documentation Index
> Fetch the complete documentation index at: https://docs.areahub.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, scopes, and key rotation.

Every request must include your API key in the `X-API-Key` header.

```bash theme={null}
curl "https://api.areahub.com/v1/wildfire/risk?lat=40.71&lng=-74.00" \
  -H "X-API-Key: YOUR_API_KEY"
```

Requests without a valid key return `401`.

## Scopes

Keys are scoped to specific topics or to bundles. A key with only the `wildfire` scope can call `/v1/wildfire/risk` but not `/v1/brownfield/risk`.

| Scope                          | Grants access to             |
| ------------------------------ | ---------------------------- |
| `bundle`                       | Both bundle endpoints        |
| *topic slug* (e.g. `wildfire`) | That single topic's endpoint |

If your key lacks the required scope, you get `403` — not `401`. The distinction matters:

* **`401`** — we don't know who you are. Missing, malformed, revoked, or expired key.
* **`403`** — we know who you are, but you're not allowed to do this.

## Keeping your key safe

<Warning>Treat your API key like a password.</Warning>

* **Never commit it to source control.** Use environment variables or a secrets manager.
* **Never expose it in client-side code.** Anyone can read it from a browser. Call the API from your backend.
* **Rotate it if it leaks.** Contact us immediately and we revoke compromised keys on the spot.

## Rotation

We support planned rotation with a grace period. During rotation, both your old and new key work simultaneously, giving you time to deploy the new one without downtime. The old key stops working when the grace period ends.

For emergency revocation (a leaked key), the old key is killed immediately.

To rotate, contact your account manager.