> ## Documentation Index
> Fetch the complete documentation index at: https://docs.otpbay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate API requests with a project API key and restrict them to your servers' IP addresses.

Every request to `https://api.otpbay.com/v1` needs a project API key in the `Authorization` header:

```bash theme={null}
curl https://api.otpbay.com/v1/project \
  -H "Authorization: Bearer otp_live_..."
```

An API key belongs to one project. Everything you send with it is billed to that project's balance, and you can only read messages that project sent.

## Create an API key

1. In the [dashboard](https://app.otpbay.com), open the project.
2. Go to **API Keys** and click **New API key**.
3. Copy the key. It starts with `otp_live_`.

<Warning>
  OTPBay stores only a hash of the key, so it can't show the key again. If you lose a key, create a new one and delete the old one.
</Warning>

Keep API keys on your server. Never put them in a mobile app, browser code or a public repository — anyone with the key can send messages on your balance.

## Check a key

Call [Get project](/api-reference/project/get) to confirm a key works and see the balance it spends from:

```json theme={null}
{
  "id": "6650c1f2a9b3e4d5f6a7b8c9",
  "name": "Acme production",
  "balance": 24.37
}
```

## Restrict keys to your IP addresses

Turn on the IP allowlist to accept API requests only from your servers. Open **Settings** in the dashboard, turn on **Restrict API keys to these addresses** and add up to 50 IPv4 or IPv6 addresses.

With the allowlist on, a request from any other address fails with `403 IP_NOT_ALLOWED`, even with a valid key. The allowlist applies to every API key in the project.

## Authentication errors

| Status | Code              | Meaning                                              |
| ------ | ----------------- | ---------------------------------------------------- |
| `401`  | `MISSING_API_KEY` | The `Authorization: Bearer` header is missing.       |
| `401`  | `INVALID_API_KEY` | The key doesn't exist or was deleted.                |
| `403`  | `IP_NOT_ALLOWED`  | The IP allowlist is on and your address isn't in it. |