> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anunnakielite.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Bearer-token authentication for all Currents APIs.

Every Currents endpoint except `GET /v1/health` requires a bearer API key in the `Authorization` header.

## Key format

Keys are environment-prefixed so they are obvious on sight in logs and tickets:

| Environment | Prefix         | Example                                          |
| ----------- | -------------- | ------------------------------------------------ |
| Sandbox     | `cur_sk_test_` | `cur_sk_test_EXAMPLEKEY123456789012345678901234` |
| Production  | `cur_sk_live_` | `cur_sk_live_EXAMPLEKEY123456789012345678901234` |

Keys are 12 characters of prefix + 32 URL-safe base64 characters. **They are returned exactly once at creation**, then stored only as a SHA-256 hash on our side. Treat them like a password.

<Warning>
  A leaked key allows full read/write to your tenant's data. Rotate immediately by contacting your account contact.
</Warning>

## Requesting a sandbox key

Email **[noreply@ventrasystems.com](mailto:noreply@ventrasystems.com)** with the subject `Currents Sandbox Access` and include your operating entity name, intended use, and the email of the technical contact who will receive the key.

You will receive:

* One sandbox API key (`cur_sk_test_…`)
* One webhook signing secret (used to verify our webhooks — see [Webhooks](/webhooks))

## Making an authenticated request

```bash theme={null}
curl https://sandbox.api.anunnakielite.com/v1/health
```

`/v1/health` is intentionally public — useful for connectivity checks before adding auth.

Every other endpoint requires the header:

```bash theme={null}
curl https://sandbox.api.anunnakielite.com/v1/exclusions \
  -H "Authorization: Bearer cur_sk_test_EXAMPLEKEY123456789012345678901234" \
  -H "Content-Type: application/json"
```

## Failure modes

| Status | Code                  | Cause                                                         |
| ------ | --------------------- | ------------------------------------------------------------- |
| 401    | `missing_credentials` | No `Authorization` header.                                    |
| 401    | `invalid_credentials` | Malformed key, unknown key, revoked key, or tenant suspended. |
| 429    | `rate_limited`        | Over the per-key request rate.                                |

Every authentication failure is recorded against your tenant's audit log with the reason, the partial key prefix, and the request ID returned in the response.