> ## Documentation Index
> Fetch the complete documentation index at: https://www.macaly.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Learn how to authenticate with the Macaly API using API keys

<Note>
  The API is available exclusively on **Enterprise plans**. [Contact us](mailto:support@macaly.com) to learn more about enterprise pricing and features.
</Note>

The Macaly API uses API keys for authentication. API keys are team-scoped and share the same credit system as the web interface.

## Getting an API Key

1. Log in to your Macaly account
2. Click on your profile (top right)
3. Go to **Settings → API Keys**
4. Click "Create New API Key"
5. Copy the key immediately (it will only be shown once)

## Using the API Key

Include the API key in the `Authorization` header for all requests:

```
Authorization: Bearer macaly_your_api_key_here
```

### Example Request

```bash theme={null}
curl -X POST https://www.macaly.com/api/chat \
  -H "Authorization: Bearer macaly_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{"content": "Create a landing page"}'
```

## API Key Format

| Property    | Value                                   |
| ----------- | --------------------------------------- |
| Prefix      | `macaly_`                               |
| Full length | 39 characters                           |
| Example     | `macaly_abc123def456ghi789jkl012mno345` |

## Security Best Practices

<Warning>
  API keys provide full access to your team's resources and credits. Treat them like passwords.
</Warning>

1. **Store keys securely** - Use environment variables, never commit to code
2. **Rotate keys regularly** - Revoke and recreate keys periodically
3. **Use separate keys** - Create different keys for different environments/applications
4. **Monitor usage** - Check your balance regularly via the dashboard
5. **Revoke compromised keys** - If a key is exposed, revoke it immediately

## Rate Limits

* Failed API key attempts are rate limited to 5 per minute per IP
* This protects against brute-force attacks

## Key Management

You can manage your API keys in the Macaly dashboard:

* **View keys** - See all active keys with their creation date and last used time
* **Create keys** - Generate new keys with optional names for identification
* **Revoke keys** - Disable keys that are no longer needed or compromised