> ## Documentation Index
> Fetch the complete documentation index at: https://docs.drumtix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticating requests to the Drumtix API.

The Drumtix API uses API keys for authentication. Every request must include a valid key in the `Authorization` header.

<Note>
  API keys require a **Pro plan**. Free plan organisations can generate keys but requests will be rejected until the plan is upgraded.
</Note>

## Generating an API key

1. Go to **Settings → API** in your dashboard
2. Click **Generate Key**
3. Choose the scopes your integration needs (see below)
4. Copy the key immediately — it is shown only once

Keys are prefixed with `dk_live_` so they're easy to identify if one leaks.

## Making authenticated requests

Pass your key as a Bearer token in the `Authorization` header:

```bash theme={null}
curl https://app.drumtix.com/api/v1/events \
  -H "Authorization: Bearer dk_live_YOUR_KEY_HERE"
```

## Scopes

When generating a key, select only the scopes your integration actually needs:

| Scope            | Description                                                                                          |
| ---------------- | ---------------------------------------------------------------------------------------------------- |
| `read`           | Read access to all data — events, tiers, orders, tickets, attendees, check-ins, and promoter payouts |
| `write`          | Create and update events and ticket tiers                                                            |
| `checkins:write` | Record door check-ins via `POST /checkins` — intended for custom check-in apps                       |

A key can hold multiple scopes. For example, a door management app would need `read` + `checkins:write` but not `write`.

## Error responses

| Status                  | Meaning                                                     |
| ----------------------- | ----------------------------------------------------------- |
| `401 Unauthorized`      | Missing or invalid key                                      |
| `403 Forbidden`         | Key is valid but lacks the required scope for this endpoint |
| `429 Too Many Requests` | Rate limit hit — see `Retry-After` header                   |

## Rotating a key

If a key is compromised:

1. Go to **Settings → API**
2. Click **Revoke** next to the key
3. Generate a new key and update all integrations

Revoked keys are invalidated immediately.

## Security

* Store keys in environment variables, never in source code or public repositories
* Never expose keys in client-side JavaScript
* Use the narrowest scope that meets your integration's needs
* Rotate keys periodically as a best practice