# Authentication

Part of the InboxWA API reference: https://inboxwa.online/docs/api . Full reference as one document: https://inboxwa.online/docs/api.md . OpenAPI: https://inboxwa.online/openapi.json

Send the key as a bearer token on every request: `Authorization: Bearer iwk_...`. Keys are created by a workspace admin on the **API Keys** page in the sidebar. The plaintext is shown once and only its hash is stored, so a lost key is revoked and replaced, never recovered.

- **Expiry.** A key can be given an expiry of up to 730 days. An expired key is refused with `key_expired`.
- **Rotation.** Rotate a key to get a replacement with the same scopes and limit. A grace period of up to 168 hours keeps the old key working while you switch over.
- **Audit.** Every call, including refused and rate-limited ones, is logged per key with method, path, status and IP, and can be read for 30 days.
- **Plan.** A workspace on Starter has no API: a key is refused with `api_not_in_plan`, and a key cannot be created. On Growth a key may make the core calls only; see [Plans and API access](https://inboxwa.online/docs/api/guide/plans.md).
- **Bad credentials.** A request with no credential at all is answered 401. A key that does not exist or has been revoked is answered 403, and so is an expired one (`key_expired`). A 403 is not a reason to retry.
- **Full-access keys are powerful.** A full-access key created by an admin can do anything that admin can, including creating, rotating and revoking keys. Give integrations scoped keys.

> **Keep keys server-side** A key carries the workspace’s data. Do not embed one in a browser page or a mobile app. Use a read-only key for dashboards and give each integration its own key so one can be revoked alone.