# Authentication

Canonical: https://www.chat-data.com/api-reference/authentication

Every request to `https://api.chat-data.com/api/v2` carries an API key as a Bearer token in the `Authorization` header.

```bash
export CHAT_DATA_API_KEY='<your full API key>'
curl https://api.chat-data.com/api/v2/get-chatbots -H "Authorization: Bearer $CHAT_DATA_API_KEY"
```

New to Chat Data? [Sign in or create an account](/signin?redirect=%2Fapi-reference%2Fauthentication), then create a key in **Workspace settings → API keys**.

## Two kinds of keys

| Key | Reaches | Create it in |
| --- | --- | --- |
| Workspace key | Every chatbot and resource in the workspace | **Workspace settings → API keys** in your [dashboard](/my-chatbots) (Owner or Admin) |
| Chatbot-scoped key | Only the chatbot it was created for | The chatbot's **Settings → API keys** page (Full or Admin access) |

[Create and train a chatbot](/api-reference/create-chatbot), [Get the current plan](/api-reference/get-current-plan) and the sub-user operations need a workspace key. A chatbot-scoped key gets `403` with *"This operation requires a user-level API key, not a chatbot-specific key"* on those. [Get all chatbots](/api-reference/get-chatbots) works with either key; a chatbot-scoped key gets just its own chatbot.

Keys are shown in full only once, when you create them. After that Chat Data, including these docs, only shows a masked form such as `sk-...a91f`.

## Keep keys on your server

An API key acts with full authority over what it reaches. Call the API from your backend and read the key from an environment variable; never put it in browser or mobile code. The code samples on every page read `CHAT_DATA_API_KEY` for that reason.

## Authentication errors

| Status | Message | Fix |
| --- | --- | --- |
| 401 | Authorization header is missing | Send `Authorization: Bearer <key>`. |
| 401 | Invalid Authorization header format | The header must be exactly `Bearer`, one space, then the key. |
| 401 | Unauthenticated Request | The key does not exist or was deleted. |
| 401 | API key workspace is unavailable or has been deleted. | The key's workspace no longer exists; create a key in a current workspace. |
| 401 | API key workspace has no owner. | Contact support: the workspace needs an owner before its keys work. |
| 401 | API access isn't included in your workspace's current plan | See [plans](/pricing). |
| 403 | This operation requires a user-level API key, not a chatbot-specific key | Use a workspace key for this operation. |