> ## Documentation Index
> Fetch the complete documentation index at: https://agents.nanonets.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Every API request is authenticated with a workspace-scoped API key.

The Public API uses **bearer tokens**. Each key is scoped to a single workspace. Any
attempt to run an agent or read a task in a different workspace returns `403 Forbidden`.

## Mint a key

<Steps>
  <Step title="Open the dashboard">
    Sign in at [agents.nanonets.com](https://agents.nanonets.com) and select the workspace
    you want the key scoped to.
  </Step>

  <Step title="Create the key">
    Go to **Settings → API Keys** and click **Create API key**. Give it a descriptive
    label; you'll want to know what it's used for when you rotate.
  </Step>

  <Step title="Copy the value once">
    The plaintext key is shown **only at creation time**. Store it in your secrets
    manager (1Password, Doppler, AWS Secrets Manager, etc.) immediately. If you lose
    it, delete the key and create a new one.
  </Step>
</Steps>

## Send the key

Include it in the `Authorization` header on every request:

```http theme={null}
Authorization: Bearer YOUR_API_KEY
```

<CodeGroup>
  ```bash cURL theme={null}
  curl https://agents.nanonets.com/api/v1/tasks/$TASK_ID \
    -H "Authorization: Bearer $NANONETS_API_KEY"
  ```

  ```python Python theme={null}
  import os, requests

  requests.get(
      f"https://agents.nanonets.com/api/v1/tasks/{task_id}",
      headers={"Authorization": f"Bearer {os.environ['NANONETS_API_KEY']}"},
  )
  ```

  ```javascript Node.js theme={null}
  await fetch(`https://agents.nanonets.com/api/v1/tasks/${taskId}`, {
    headers: { Authorization: `Bearer ${process.env.NANONETS_API_KEY}` },
  });
  ```
</CodeGroup>

## Failure modes

| Status             | Cause                                                             | Fix                                       |
| ------------------ | ----------------------------------------------------------------- | ----------------------------------------- |
| `401 Unauthorized` | `Authorization` header missing                                    | Add the header                            |
| `401 Unauthorized` | Header is not `Bearer <key>`                                      | Fix the format                            |
| `401 Unauthorized` | Key was revoked or never existed                                  | Mint a new key                            |
| `403 Forbidden`    | Key is valid, but the agent/task belongs to a different workspace | Use a key scoped to the correct workspace |

## Security

<Warning>
  Never commit API keys to source control. The dashboard scans for leaks but cannot
  catch every case, so use environment variables and a secrets manager.
</Warning>

* **Rotate** keys at least every 90 days.
* **Revoke** a key immediately if you suspect it has leaked. Existing in-flight tasks
  finish; subsequent requests fail.
* **Scope per environment**: mint separate keys for production, staging, and local
  development. Don't share keys across them.