> ## Documentation Index
> Fetch the complete documentation index at: https://tryklint.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Fetch /llms.txt for the complete page index before exploring further. Every docs page is available as markdown by appending .md to its URL. Coding agents should start at /for-agents/coding-agents.md.

# Authentication

> Authenticate Klint API requests with an API key sent as an Authorization: Bearer header.

Every request sends an API key as a bearer token:

```bash theme={null}
curl "https://api.tryklint.ai/v1/instagram/accounts/ig_account_01j2k9m4q7" \
  -H "Authorization: Bearer $KLINT_API_KEY"
```

* You create keys in the Klint dashboard.
* Store the key in the `KLINT_API_KEY` environment variable. Never store it in code, prompts, or repositories.
* In agent contexts, provide the key through the environment. Klint never requires an interactive login mid-task.

<Note>
  The key format and the account-free onboarding flow (trial token → `npx klint setup` → claim) are planned, not final contract.
</Note>

## If you get a 401

A missing, malformed, or revoked key returns `401 authentication-required` as a [problem object](/docs/api-reference/errors):

```json theme={null}
{
  "type": "https://api.tryklint.ai/problems/authentication-required",
  "status": 401,
  "request_id": "req_example_50",
  "detail": "Missing or invalid API key. Send Authorization: Bearer <api-key>."
}
```

Check these items in order:

1. The `Authorization: Bearer ` prefix is present.
2. The key has no surrounding quotes or whitespace.
3. The key is active in the dashboard.

A `401` is never retryable with the same credentials.

## Key safety

* Treat keys as secrets.
* Rotate a key on suspicion of exposure.
* Scope one key per integration.
* Revoke unused keys.
* Klint keys will appear in secret-scanning feeds at launch. Treat a key that lands in a public repository as compromised.