> ## Documentation Index
> Fetch the complete documentation index at: https://docs.squawkvoice.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate API requests with an API key in the X-API-Key header

Every request needs an API key, sent in the `X-API-Key` header:

```bash theme={null}
curl https://api.squawkvoice.ai/api/v1/assistants/{assistantId}/guidelines \
  -H "X-API-Key: squawk_sk_live_..."
```

## Get a Key

Create a key in Studio at **Manage → API Keys** with **New Key**. The key is shown once, when you create it, so copy it then and store it somewhere safe, such as your secrets manager. Keys start with `squawk_sk_live_`. See [API Keys](https://docs.squawkvoice.ai/manage/api-keys.md) for creating, expiring and revoking keys.

## What a Key Can Reach

A key acts as the person who created it, inside their account:

* It reaches every campaign and every agent in the account, not only the one you were looking at when you created it.
* A campaign or agent in any other account answers `403`.
* Keys have no scopes, so you can't limit one to a single campaign or agent.
* Changes a key makes, such as replacing an agent's guidelines or publishing it, are recorded in [Audit Logs](https://docs.squawkvoice.ai/manage/audit-logs.md) with the key's creator as the **Actor**.

Use one key per integration, so you can revoke one without breaking the others.

## When a Key Is Refused

A request with no key, or with a key that is unknown, revoked or expired, answers `401`. The reply is the same in every case, so it doesn't say which:

```json theme={null}
{
  "success": false,
  "error": "Unauthorized: Invalid credentials"
}
```

Check that the key is sent in an `X-API-Key` header, and that it is still listed at **Manage → API Keys** and hasn't expired. An expired key can't be extended: create a new one.

Use a key with the endpoints in this reference. Most other SquawkVoice endpoints refuse a key with a `401`, which reads like a broken key rather than an endpoint that doesn't take one.

> [!WARNING]
>
> Keep keys out of browser and mobile code. Anyone who has a key can place calls, and change and publish agents, in your account. If a key leaks, revoke it at **Manage → API Keys** straight away: it stops working on its next request.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.