# Authentication

> Every call carries an API key in a header.


Every endpoint except [the OpenAPI spec](https://payday.direct/api/v1/openapi.json) needs a key. Send it one of two ways:

```bash
curl -H "Authorization: Bearer pd_YOUR_KEY" https://payday.direct/api/v1/stats
curl -H "X-API-Key: pd_YOUR_KEY" https://payday.direct/api/v1/stats
```

> Warning: A key in the URL (`?key=`, `?api_key=`, `?token=`) is refused with `400 key_in_url`, because URLs end up in logs, browser history and Referer headers. If you ever put one in a link, revoke it.

## Keeping a key safe

- Call the API from your server or bot. Anything a browser loads, its user can read.
- Payday keeps only a SHA-256 fingerprint of each key, so nobody at Payday can read it back. It is shown to you once.
- Revoke a key the moment it may have leaked, from [API keys](/developers/api-keys) when signed in, or from anywhere by sending the key itself:

```bash
curl -X DELETE -H "Authorization: Bearer pd_YOUR_KEY" https://payday.direct/api/v1/keys/self
```

A revoked key stops working everywhere within 15 seconds.

## Two kinds of key

| | Read key | Launch key |
|---|---|---|
| Sign-in | None | Signed in with X |
| Reads data | Yes | Yes |
| Launches coins | No | Yes, when made with launching switched on |
| How many | 3 new a day per address | 5 active, 10 new a day per account |
| Shared allowance | All keys from one address share 1,200 requests a minute | 600 a minute each |
| Expires | After 90 days unused | No |
| Listed on API keys | No, keep it safe | Yes, with usage and Revoke |

Launching cannot be switched on later. Make a new key instead.