> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clickproof.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create and use clickproof API keys.

The API authenticates with **team API keys**. A key belongs to a team and can do
anything the CI flow needs: upload builds, start runs, and read results for that
team's projects.

## Create a key

In the dashboard, go to **Integrations → GitHub** and create a key. It's shown
**once** — copy it immediately. Only a hash is stored, so a lost key can't be
recovered; revoke it and create a new one.

Keys look like:

```
cp_live_9f2ab7c1d4e5f6a7b8c9d0e1f2a3b4c5
```

<Warning>
  Treat API keys like passwords. Store them as CI secrets, never commit them, and
  revoke any key that may have leaked.
</Warning>

## Use a key

Send it as a Bearer token on every request:

```bash theme={null}
curl -H "Authorization: Bearer $CLICKPROOF_API_KEY" \
  https://clickproof.app/api/v1/runs/RUN_ID
```

A missing key returns `401 missing API key`; an unrecognized one returns
`401 invalid API key`.

## Revoke a key

In **Integrations → GitHub**, click **Revoke** next to the key. Any pipeline still
using it starts failing immediately with a `401`.