> ## Documentation Index
> Fetch the complete documentation index at: https://docs.originalis.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, scopes, and how identity is resolved.

Every request needs an Originalis API key, sent either way:

```bash theme={null}
curl -H "Authorization: Bearer ak_..." "https://api.originalis.ai/api/v1/deals"
curl -H "X-API-Key: ak_..."            "https://api.originalis.ai/api/v1/deals"
```

Keys are minted in the app at [Integrations → API Keys](https://app.originalis.ai/app/integrations/api-keys); the secret is shown once. Keys support expiry, overlap rotation, and immediate revocation.

## Server-resolved identity

Keys are bound to a user in your org. Identity and org scope are resolved **server-side** from the key — the API never accepts a client-supplied user or organization, and a key can never read another org's rows (a cross-org resource is a plain `404`).

## Read vs. write scope

| Scope        | Can do                                                                          |
| ------------ | ------------------------------------------------------------------------------- |
| Read-only    | Every `GET`                                                                     |
| Read & write | Everything, plus the `POST` actions (analysis, research) and webhook management |

A read-only key calling an action gets `403` with a pointer to the keys page. Actions additionally draw down a separate [daily actions budget](/core/rate-limits).