> ## Documentation Index
> Fetch the complete documentation index at: https://docs.canary.effectiveai.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate requests with an Effective API key.

Use an Effective user API key issued for the tenant you intend to access. If
you do not have one, ask your Effective administrator to provision it.

Send the key in the `Authorization` header of each request:

```http theme={null}
Authorization: Bearer sk-eai-...
```

Keep the key in an environment variable or your application's secret store.
Do not put it in URLs, committed source files, or shared transcripts.

The key determines the authenticated user and tenant. The current-user
response's `tenantId` lets you verify which tenant you are using.

V2 currently supports ordinary user API keys. Record-bot, scoped user, and
app-specific credentials have separate access restrictions and are not a
substitute for a user API key on this endpoint.

## Authentication failures

API-generated v2 errors return a human-readable `error` and a stable `code`:

```json theme={null}
{ "error": "Authentication required", "code": "unauthenticated" }
```

* **401 Unauthorized:** credentials are missing, invalid, expired, revoked,
  or unsupported on this endpoint. Check the key before retrying.
* **403 Forbidden:** the authenticated credential does not permit the operation.
  Use a credential with the appropriate access.

Use `code` and HTTP status for control flow, not message text. Unknown future codes
fall back to HTTP status. Errors may also include `requestId` for support and bounded
`details` for invalid input; both are optional. Authentication can fail before a
request ID is available. V2 responses use `Cache-Control: private, no-store`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.