> ## Documentation Index
> Fetch the complete documentation index at: https://docs.planewallet.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Company-scoped keys and explicit permissions.

Send your API key in the `Authorization` header:

```http theme={null}
Authorization: Bearer YOUR_PLANE_API_KEY
```

Each key belongs to one company and one environment. The server derives both from the key; a request header cannot turn a sandbox key into a live key.

Create and revoke keys in Developers in the company console. Each reference page lists the required permission. Full card details require `cards:read_sensitive`, separately from ordinary card access.

Keep keys in server-side secret storage. Do not include them in mobile applications, browser bundles, shared screenshots, or documentation examples.

An invalid or revoked key is rejected. The company console's cookie session is separate from API-key authentication.