> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oviond.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Oviond authenticates API requests with Bearer tokens. Learn how to generate an API key, set the Authorization header, and handle auth errors. All API fields are snake_case.

Oviond's REST API uses Bearer token authentication. Every request must include a token in the `Authorization` header. For programmatic access, generate an API key from your settings. This page explains how to create an API key and pass it correctly in your requests.

<Note>
  The Oviond web app signs in with Supabase Auth and sends a session JWT as its Bearer token. For your own scripts and integrations, use an API key instead, as described below.
</Note>

## Generate an API key

API keys require the **Manage API keys** permission, so you must be an account owner or admin.

<Steps>
  <Step title="Open API key settings">
    In the Oviond app, go to **Settings → API keys**.
  </Step>

  <Step title="Create a new key">
    Click **Create**. Give it a descriptive name (for example, "Zapier integration" or "Custom dashboard") so you can identify it later. Choose an access level: **View**, **Edit**, or **Full**. The key inherits your role and client access, capped at the access level you pick.
  </Step>

  <Step title="Copy and store the key">
    Your key is shown once and starts with `oviond_`. Copy it and store it securely — you won't be able to see the full key again after you close this dialog.

    <Warning>
      Treat your API key like a password. Do not commit it to version control or expose it in client-side code.
    </Warning>
  </Step>
</Steps>

## Make authenticated requests

Include your API key in the `Authorization` header as a Bearer token on every request:

```bash theme={null}
curl -X GET https://api.oviond.com/v1/users/me \
  -H "Authorization: Bearer YOUR_API_KEY"
```

Replace `YOUR_API_KEY` with the key you generated above.

## Example: Fetch your account

```bash theme={null}
curl https://api.oviond.com/v1/users/me \
  -H "Authorization: Bearer YOUR_API_KEY"
```

A successful response wraps your user profile in the standard success envelope. All fields are snake\_case:

```json theme={null}
{
  "success": true,
  "data": {
    "id": "...",
    "account_id": "ov:26AbCdEfGhIjKlMnOp",
    "fullname": "Your Name",
    "email": "you@yourcompany.com",
    "email_verified": true,
    "role": "admin"
  }
}
```

## Authentication errors

Errors return the standard error envelope:

```json theme={null}
{
  "success": false,
  "error": {
    "message": "Invalid or revoked API key",
    "status_code": 401
  },
  "meta": {
    "request_id": "..."
  }
}
```

| Status             | Meaning                                                                                            |
| ------------------ | -------------------------------------------------------------------------------------------------- |
| `401 Unauthorized` | The `Authorization` header is missing or malformed, or the key is invalid or revoked.              |
| `403 Forbidden`    | Your key is valid but doesn't have permission for this resource, or your account lacks API access. |

If you receive a `401`, double-check that you've included the `Authorization: Bearer <key>` header and that the key hasn't been revoked.

## Manage your API keys

You can list, create, and revoke API keys at any time from **Settings → API keys** in the app, or via the [API Keys API](/api-keys/list).

<Note>
  Each API key is scoped to your account and inherits the role and client access of the person who created it, capped at the key's access level.
</Note>