> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codecobra.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create a CodeCobra API key and use it to authenticate your requests.

The API authenticates with a personal API key, sent as a bearer token.

## Creating a key

<Steps>
  <Step title="Go to Settings → API keys">
    The tab lists any keys you already have, showing their prefix and when each was last used — so you can tell which is which without storing the secrets anywhere.
  </Step>

  <Step title="Create a key">
    Give it a name that says where it will be used — "Zapier", "nightly export", "Ben's laptop". You'll thank yourself when it's time to revoke one.
  </Step>

  <Step title="Copy it now">
    The key is shown **once**. We store only a hash of it, so we cannot show it to you again. If you lose it, revoke it and create another.
  </Step>
</Steps>

Keys start with `cc_`.

## Using a key

```bash theme={null}
curl -H "Authorization: Bearer cc_your_key_here" \
  https://codecobra.ai/api/projects
```

## What a key can reach

A key acts as you. It can reach exactly what you can reach — your personal projects, and organization projects your teams give you access to — and no more. It does not inherit an organization role you don't have.

## Revoking a key

Settings → API keys → revoke. It stops working immediately.

Revoke a key when the integration using it is retired, when someone who had it leaves, or any time you're not certain where it ended up. Creating a replacement takes seconds, so there is no reason to hesitate.

<Warning>Treat a key like a password. Don't commit one to a repository, don't paste one into a shared document, and don't put one in a client-side application where a visitor can read it.</Warning>

## Keys can't manage keys

The key endpoints themselves require a signed-in session, not an API key. A leaked key cannot be used to mint, list or revoke other keys — it is limited to whatever it can already do, and cannot widen its own reach.