> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quotamint.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate calls to the runtime API

## Project API keys

Send a project key as a bearer token:

```bash theme={null}
curl "$RUNTIME/v1/check" \
  -H "Authorization: Bearer $QUOTAMINT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"customerId":"user_123","feature":"generate_image","quantity":1}'
```

Project keys are environment-bound. `qm_test_` selects development or staging; `qm_live_` selects production. The runtime resolves the project and environment from the key alone before the request is processed.

## Authentication failures

All of these are `401`:

* Missing or malformed bearer header
* Unknown key
* Revoked key
* Key prefix/environment mismatch

The response uses the standard error envelope described in [errors](/api/errors). Raw secrets are never logged.

## Key lifecycle

Create and revoke keys from the dashboard. A newly created secret is returned once. Store it immediately, create a replacement for rotation, then revoke the old key after deployment.