# Authentication Canonical HTML: https://spoolis.com/docs/authentication. This page is also available in machine-readable Markdown. Authenticate Spoolis API requests with production API keys or short-lived sandbox bearer tokens. ## Production API keys Production keys begin with `spk_live_` and are managed at `/dashboard/api-keys`. Send a key in the `Authorization: Bearer ` header. The full key is shown once. ## Key scopes Full-scope keys can use the complete production lifecycle, including operations that require human-authorized settlement authority. Verify-scoped keys can create one-call verification results, submit evidence, and run verification before settlement is committed. Counterparty keys are bound to one Spool and can read it, accept or decline it, and submit evidence while its outcome is active. ## Authentication errors A missing, unknown, or revoked production key returns HTTP 401 with `error: Invalid API key`, `code: unauthenticated`, `retryable: false`, `remediation`, `field: headers.authorization`, and `docs`. ## Sandbox tokens Routes under `/api/sandbox/*` use short-lived bearer tokens minted by `POST /api/sandbox/session`. They are separate from production API keys. ## Rate limits See the [API reference](/docs/api) for the implemented limits and response behavior.