<!-- Markdown copy of https://docs.creatorain.com/get-started/authentication/ -->
# Authentication and keys

Every call sends a key in the `Authorization` header:

```http
Authorization: Bearer crp_test_...
```

Never put a key in a URL, a log or client-side code.

## Hosts

Mode

Host

Keys

Live

`https://api.creatorain.com/v1`

`crp_live_...`, `crp_rk_live_...`

Sandbox

`https://sandbox.api.creatorain.com/v1`

`crp_test_...`, `crp_rk_test_...`

**Not live yet:** Neither host answers yet. Until `api.creatorain.com` resolves, the live API will also answer at `https://data.creatorain.com/v1`.

## Key kinds

-   `crp_live_` and `crp_test_`: standard keys, live and sandbox.
-   `crp_rk_live_` and `crp_rk_test_`: restricted keys, same modes.
-   `crp_obs_`: an onboarding session secret. It polls one session and nothing else. See [Agent quick start](/get-started/agent-quick-start/).

A test key on the live host is `401 test_key_on_live`. A live key on the sandbox is `401 live_key_on_sandbox`.

A key is shown once, when it is made. CreatoRain stores only a hash of it. A key acts for **one workspace**.

## Scopes

Scope

Lets the key

`read`

Read the account, locations, visits, videos and bill preview.

`samples:read`

Read creator samples. **(Not live yet)**

`locations:write`

Add stores.

`balance:write`

Top up, refund, lower limits. **(Not live yet)**

`creators:read`

Creator data. **(Not live yet)**

`webhooks:write`

Manage webhook endpoints. **(Not live yet)**

A call without the scope it needs is `403 scope_missing`.

## IP allowlist

A key may carry an IP allowlist. A request from another address is `403 forbidden_ip`.

## Failed authentication

Twenty failed authentications (missing or unknown key) from one address within a minute block that address for 15 minutes.

## Live keys

A live key needs one paid top-up on the account first. See [Going live](/get-started/going-live/).

## Leaked keys

Live key prefixes will be registered with GitHub secret scanning, so a leaked key is revoked on report. **(Not live yet)**