> For the complete documentation index, see [llms.txt](https://docs.castmagic.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.castmagic.io/authentication.md).

# Authentication

Authenticate with the Castmagic API using a secret key.

Generate an API key in your [Castmagic developer dashboard](https://app.castmagic.io/developer) under **Secrets**. Keys look like `cast_sk_...`.

Send it as a bearer token on every request:

```
Authorization: Bearer cast_sk_...
```

Basic auth also works — pass the key as the username with an empty password.

{% hint style="info" %}
Keys are **personal**: a request acts as the user who created the key, across the spaces that user belongs to.
{% endhint %}

Keep your API secret safe! You can generate as many as you like, but we're unable to reveal a secret again once it has been generated.

## Plan access

API access depends on your plan. A `403` with `"Your plan does not include API access."` is the plan gate, not a bad key — the account has no active subscription, or its plan's API tier is `none`. Individual endpoints are further grouped into tiers; see [Plans & Tiers](/reference/plans-and-tiers.md).