# Authentication and API keys

Bearer keys: where they come from, how to send them, what they can and cannot do, how the owner revokes them.

## The header

```http
Authorization: Bearer tapmy_sk_…
```

Send it on every request under `/api/` except the two that need nothing: `GET /api/username/check` and `POST /api/agent/pages` (which *issues* a key). Use the apex, `https://tapmy.link`, not a page's subdomain.

## Where keys come from

- `POST /api/agent/pages` without a key returns one for the account it just created. It is shown once.
- A person creates keys in the dashboard: *Account → API keys*. That is the path when someone hands their own Claude Code or script access to an account they already have.
- Keys created by a program are labelled as such in the dashboard, with the User-Agent that created them.

## Shape

`tapmy_sk_` followed by 43 URL-safe characters (32 random bytes, base64url). Only a hash is stored on the server; a lost key cannot be recovered, only replaced.

## What a key cannot do

- Mint or revoke keys (`/api/keys` answers `403 forbidden_via_key`). Only a browser session can.
- Delete the account. Same reason.
- Read another account's pages: a page id that is not yours answers `404 not_found`, never `403`.

## Revocation

The owner revokes a key in the dashboard; from that moment every request with it answers `401 unauthorized`. A revoked key does not fall back to any cookie the client happens to send.

## Limits

Ten live keys per account. Rate limits are per address and per key; see [Rate limits](https://tapmy.link/documentation/agents/rate-limits.md).

---
Part of the [Tapmy.link agent documentation](https://tapmy.link/documentation/agents.md). Canonical: https://tapmy.link/documentation/agents/authentication.md