# Authentication

ConnectPlane public API operations require an API key in the `X-API-Key`
request header. An account administrator creates, scopes, rotates, and revokes
keys from the authenticated Portal.

Store keys in a runtime secret store. Never put a key in source control, a URL,
browser JavaScript, logs, chat, or an AI-agent prompt. Refer to a key by its
environment variable or secret-store identifier.

- `401` means the key is missing, invalid, expired, or revoked.
- `403` means the key is valid but lacks the required permission.