> ## Documentation Index
> Fetch the complete documentation index at: https://docs.check.et/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to generate API keys and authenticate requests

## API keys

Check.et uses **bearer token** authentication. Every request must include your API key in the `Authorization` header:

```
Authorization: Bearer chk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

Keys start with the `chk_` prefix. The full key is shown **once** when created - copy it immediately and store it in a secrets manager or environment variable.

## Requirements

<Note>
  API keys can only be created by **business accounts**. If you registered as a personal user, go to [check.et/setup](https://check.et/setup) to create a business profile first. API access is not available on personal accounts.
</Note>

## Creating a key

1. Log in and go to **Dashboard → API Keys**
2. Click **Create key**
3. Give it a descriptive name (e.g. `production`, `staging`)
4. Optionally assign it to a specific branch
5. Copy the displayed key

## Branch targeting

Your business can have multiple branches. Each API key is tied to a branch. To target a specific branch when using a key that spans multiple branches, pass the `X-Branch-Id` header:

```
X-Branch-Id: 55
```

If you omit the header, requests resolve to the branch the key was created for.

## Key rotation

To rotate a key:

1. Create a new key in the dashboard
2. Update your application to use the new key
3. Revoke the old key

There is no automated rotation - you control the lifecycle.

## Security best practices

* Never commit keys to source control
* Use environment variables: `CHECK_ET_API_KEY=chk_...`
* Create separate keys for `staging` and `production`
* Revoke unused keys promptly from the dashboard
* Each key is scoped to a branch - limit blast radius by using branch-specific keys