> For the complete documentation index, see [llms.txt](https://docs.adaptria.locaria.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.adaptria.locaria.com/client-api/authentication.md).

# Authentication & API keys

Every request to the Adaptria Public API is authenticated with a static API key sent in the **`Api-key`** HTTP header (note the exact casing). There is no token exchange, refresh token or separate sign-in step: the key is sent directly on each request.

## Generating an API key

You can create an API key in either of two ways:

* **Adaptria Portal**: go to **Settings → API Keys** and generate a new key.
* **Contact your admin**: ask your Adaptria administrator to create an API key for you.

Keys are issued in the format `lla_live_<32 characters>`.

{% hint style="warning" %}
The full key is shown **only once**, at the moment it is created. Copy it and store it somewhere secure straight away, as it cannot be retrieved again later. If you lose a key, revoke it and generate a replacement.
{% endhint %}

Your key is scoped to your organisation: list and detail endpoints return only the companies and records your credential is permitted to see.

## Sending the key

Add the `Api-key` header to every request:

```bash
curl https://api.adaptria.locaria.com/api/public/v1/rfqs \
  -H "Api-key: lla_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
```

## Invalid or revoked keys

If a key is missing, malformed, revoked or expired, the API responds with `401 Unauthorized` and a machine-readable error code (for example `AUTH_API_KEY_INVALID`, `AUTH_API_KEY_REVOKED` or `AUTH_API_KEY_EXPIRED`). See [Errors & status codes](/client-api/errors.md) for the full error envelope.