# Authentication

> Source: https://pixelsystems.com/docs/api/authentication


The Pixel Systems API uses API Key authentication for server-side requests.

## Access the API

Include your API key in the [`Authorization`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Authorization) header of every request, using the `Bearer` scheme:

```http
Authorization: Bearer {api_key}
```

For example, calling [List jobs](https://pixelsystems.com/docs/api/list-jobs) (`/v1/jobs`):

```bash
curl -X GET "https://api.pixelsystems.com/v1/jobs?applicationId={application_id}" \
  -H "Authorization: Bearer {api_key}"
```

Make all requests over HTTPS. A request with a missing or invalid key returns `401` with the error code `unauthorized`. A valid key whose organization does not have API access returns `403` with the error code `forbidden`; see [error codes](https://pixelsystems.com/docs/api/error-codes).

## API keys

API keys are scoped to an [application](https://pixelsystems.com/docs/concepts#application): a key authorizes requests for its application only.

To get access, [contact us](https://pixelsystems.com/contact) or [book a demo](https://pixelsystems.com/book-a-demo) and we set up your organization. API access is enabled per organization. Where it is enabled, API keys are self-serve for organization admins: create an application in the dashboard (or open an existing one), then create or revoke its API keys. Where it is not, no new keys can be created, and existing keys stop working until it is turned back on.

## Keep your keys safe

> **API keys are secrets**
>
> A key authorizes every operation on its application, so treat it like a password.

- Use keys on servers only. Never embed one in browser code, a mobile app, or version control; for uploads from the browser, use the [client SDK](https://pixelsystems.com/docs/sdk/client) or the [no-code](https://pixelsystems.com/docs/no-code) option instead.
- Store keys in environment variables or a secrets manager, not in source code.
- If a key leaks, revoke it in the dashboard and create a new one. Revoking is self-serve for organization admins.