---
title: Authentication
description: Create, use, protect and revoke Qaf API keys. Keys belong to your Qaf account and are created in qaf.ai Settings › API keys.
---

The Qaf API authenticates every request with an API key that belongs to your Qaf account. Send it as a bearer token:

```http
Authorization: Bearer qaf_sk_…
```

The [MCP server](/mcp) doesn't use API keys: AI apps sign in with your Qaf account instead.

## Create a key

1. Open [Settings › API keys](https://qaf.ai/login?redirect=%2F%3Fsettings%3Dapi-keys) on qaf.ai. Sign in first if asked; a guest session can't create keys.
2. Select **Create key** and give the key a name that says where you'll use it, such as "Production server".
3. Copy the key and store it somewhere safe, such as your server's secret store. The key is shown only once; Qaf keeps only a hash of it.

Keys start with `qaf_sk_`. The list in **Settings › API keys** shows the start of each key, when it was created and when it was last used, so you can tell keys apart without seeing them in full.

An account can have up to 10 keys at a time, and can create up to 20 keys an hour.

## Keep keys secret

A key gives full access to the API under your account, so treat it like a password.

- **Call the API from your server.** Never put a key in a web page, a mobile app or a desktop app, where anyone can read it.
- **Keep keys out of source control.** Read them from an environment variable or a secret store.
- **Use one key per app or environment.** You can then revoke one without stopping the others.

All of an account's keys share one [rate limit](/api/rate-limits), so a second key doesn't add capacity.

## Revoke a key

In **Settings › API keys**, select the delete icon next to the key, then **Revoke**. Apps using it stop working right away, and revoking can't be undone. Create a new key to replace it.

If a key may have leaked, revoke it first, then create a new one.

## Keys and your account

- **Requesting account deletion** revokes all your keys, so requests with them get a `401`.
- **A suspended account's** keys are refused with `403` while the suspension lasts, and work again when it ends.

## Try it in the reference

The [API reference](/reference) has a **Try it** panel. It sends your key from your browser straight to api.qaf.ai; the docs site never receives it. If you select **Remember on this device**, the key is stored in this browser. Use a separate key for testing, and revoke it when you're done.

## Errors

| Status | Message | Cause |
| --- | --- | --- |
| `401` | `Send an API key in the Authorization header, as Bearer <key>.` | The `Authorization` header is missing or isn't a bearer token. |
| `401` | `Invalid API key.` | The bearer token isn't a Qaf API key, or names a key that doesn't exist or was revoked. |
| `401` | `This key can't call the Qaf API. Create a key in qaf.ai Settings › API keys.` | The key starts with `qaf_live_`, an older kind of key that v1 doesn't accept. |
| `403` | `This Qaf account can't use the API.` | The key's account is suspended. |
| `429` | `Too many requests. Try again later.` | The key doesn't exist or was revoked, and your network address has sent too many such keys. `data.reason` is `invalid_keys`. Fix the key rather than retrying. |

A `401` has a `WWW-Authenticate` header: `Bearer realm="api.qaf.ai"` when the request sent no key, and `Bearer realm="api.qaf.ai", error="invalid_token"` when it sent a key that can't be used. See [Errors](/api/errors) for the error format.