# Authentication

> Authenticate Curriculo API calls with a Developer Console key sent as a bearer token. How keys are created, expired and revoked, and what 401 and 403 mean.

**Source:** /docs/authentication/ (Curriculo Docs)  
**Updated:** 12 October 2026  
**Contact:** hello@curriculo.me

Every request to the Curriculo API carries your Developer Console key as a bearer token:

```http
Authorization: Bearer key_<id>_<secret>
```

```bash
curl -X POST https://api.curriculo.me/public/detect-language/ \
  -H 'Authorization: Bearer key_abc123_yoursecret' \
  -H 'Content-Type: application/json' \
  -d '{"text": "Ingeniera de software con diez años de experiencia"}'
```

## One key, every operation

A Console key works for every operation the moment it is created. There are no per-endpoint credentials, no scopes and no per-capability request. There is no ATS login, no session cookie and no organisation header involved.

## Getting API keys

Sign in to the [Developer Console](https://console.curriculo.me) and open **API keys**.

- Each key can carry a name and an **optional expiry**. A key without an expiry works until you revoke it.
- The plaintext value is returned **once**, at creation. Only a 16-character prefix and a SHA-256 hash are stored, so a lost key is replaced, never recovered.
- **Revocation is immediate.** The next request with a revoked key gets `401`.
- An account can hold up to 25 active keys.

## What a key needs to serve traffic

A key is accepted when its account:

- has finished provisioning (this happens on first sign-in);
- has a prepaid credit balance above zero (new accounts start with a $5.00 free credit);
- is not suspended.

## Key hygiene

> [!WARNING]
> Treat an API key like a password. Never commit it to source control or paste it into an untrusted client, and revoke it as soon as it is exposed.

- **Issue separate keys per environment or team** to keep usage attributable and each key independently revocable.
- **Keys are scoped to your organisation** and see nothing else.
- **A key cannot manage the account.** It cannot mint keys or change billing, so a leaked key can never escalate into account control.

## Authentication errors

| Status | Message | What to do |
|---|---|---|
| `401` | "Missing API token…" | Send the `Authorization: Bearer` header. |
| `401` | "Invalid API token." | The key is unknown or revoked. Create a new key. |
| `401` | "API token expired." | The key passed its expiry. Create a new key. |
| `401` | "Unknown API endpoint" | The path under `/public/` does not exist. Check the spelling and the trailing slash. |
| `403` | No prepaid credit ("…Buy credits in the Console.") | Add credit in **Console → Billing**. |
| `403` | Account suspended | Contact us. |
| `403` | "Account provisioning incomplete" | Wait for provisioning to finish after first sign-in. |

See [Errors](/docs/errors/) for the full list.