# Authentication

> Secret keys, environments, and keeping keys safe.

Source: https://docs.onari.xyz/docs/api/authentication

Every request to `https://api.onari.xyz/v1` needs a secret key:

```bash
-H "Authorization: Bearer sk_live_4f2aQx…"
```

| Key | Environment |
|---|---|
| `sk_test_` + 32 characters | Sandbox |
| `sk_live_` + 32 characters | Live |

Create keys in **Developers → API keys** (owners, admins and developers). The full key is shown once; Onari stores only a hash of it.

## Keep keys on your server

Secret keys can send events and make Rewards Hub links for any player. Never put them in a mobile app, a web page or a public repository. Your app talks to your server, and your server talks to Onari.

## Rolling and revoking

- **Roll** makes a new key with the same name; the old one keeps working for 24 hours so you can deploy without downtime.
- **Revoke** stops a key immediately.

A key stops working within a minute of being rolled out or revoked. Requests with a missing, malformed or revoked key get `401 invalid_api_key`.