---
title: Authentication
description: How to authenticate, what a key may do, and the limits a key is held to.
icon: key-round
sidebar:
  order: 2
---

Every request needs an `Authorization: Bearer bloomcount_…` header. Keys are
created from **Settings → API** in the app and are scoped: a key without
`products:write` cannot create products, and so on.

:::warning[Keys are secrets]
A key carries the permissions of whoever issued it. Keep it server-side, and
rotate it from the same settings page if it leaks.
:::

## Rate limits and quotas

- **Per key**: 60 requests per minute.
- **Per tenant, per month**: set by the plan's `apiLimit` entitlement.

Exceeding either returns `429`. Live usage is shown on the API settings page.

## Idempotency

Every POST endpoint honours `Idempotency-Key`. Replays return the cached
response verbatim, for 24 hours, scoped per key. Retrying a failed request
therefore never double-creates data.