> ## Documentation Index
> Fetch the complete documentation index at: https://docs.demomatic.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate Demomatic API requests using API keys passed as Bearer tokens.

The Demomatic API uses API keys for authentication. Include your key in every request as a Bearer token in the `Authorization` header.

<Info>
  API access requires a **Starter** or **Growth** subscription plan. Requests from accounts on other plans receive a `403 Forbidden` response.
</Info>

## Get an API key

Create an API key in your account settings:

<Steps>
  <Step title="Open Settings">
    Navigate to **Settings > API Keys** in the Demomatic dashboard.
  </Step>

  <Step title="Create a new key">
    Click **New API Key**, give it a name, and choose a permission level.
  </Step>

  <Step title="Copy the key">
    Copy the key immediately — it is only shown once. Store it securely (for example, as an environment variable).
  </Step>
</Steps>

<Warning>
  Your API key is a secret. Never commit it to source control or expose it in client-side code.
</Warning>

For more details on managing keys, see the [API Keys guide](/guides/api-keys).

## Permission levels

Each API key has one of two permission levels:

| Permission   | Allowed methods                |
| ------------ | ------------------------------ |
| `read_only`  | `GET` only                     |
| `all_access` | `GET`, `POST`, `PUT`, `DELETE` |

Use `read_only` keys when you only need to read data (for example, fetching video lists or stats). Use `all_access` keys when you need to generate or delete videos.

## Authenticate a request

Pass your API key as a Bearer token in the `Authorization` header:

```bash theme={null}
curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://api.demomatic.tech/v1/videos
```

## Error responses

| Scenario                                                       | Status             |
| -------------------------------------------------------------- | ------------------ |
| `Authorization` header is missing or malformed                 | `401 Unauthorized` |
| API key is invalid or does not exist                           | `401 Unauthorized` |
| Key has `read_only` permission but request uses a write method | `401 Unauthorized` |
| Account plan does not include API access                       | `403 Forbidden`    |

See [Errors](/api-reference/errors) for full details on error response shapes.