> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.getoutprice.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.getoutprice.com/_mcp/server.

# Authentication

```bash
curl https://getoutprice.com/v1/dashboard/summary \
  -H "X-API-Key: pw_your_key_here"
```

## Creating keys

Keys are created by a person signed in to the
[dashboard](https://getoutprice.com/app), with
`POST /v1/api-keys` (in the [API Reference](/api-reference)). A key cannot create
other keys, so if one leaks, revoking it is enough.

While signed in, open the browser's developer console on the dashboard and run:

```js
await (await fetch("/v1/api-keys?name=my-integration", { method: "POST" })).json()
```

Add `&read_only=true` for a read-only key. The `key` in the answer is the
only time it is shown.

* **Full access** keys can read and change everything the dashboard can,
  apart from signing in and account security.
* **Read-only** keys can only read. Use them for reporting and dashboards;
  any request that would change something gets `403`.

Only a hash of each key is stored, so a lost key cannot be shown again:
revoke it and make a new one.

## Keeping keys safe

> **Warning**
>
> An API key is a password for your account. Never put it in a web page,
> a mobile app or a public repository: anyone who can see it can use it.

* Keep keys in environment variables or a secrets manager, not in code.
* Use a separate, named key for each program, so you can revoke one alone.
* Prefer read-only keys wherever writing is not needed.
* Revoke keys you no longer use. The dashboard shows when each was last used.

## When authentication fails

| Status | Meaning                                                                                                    |
| ------ | ---------------------------------------------------------------------------------------------------------- |
| `401`  | No key was sent, or the key is wrong or revoked.                                                           |
| `403`  | The key is read-only and the request changes something, or the account's plan does not include API access. |

Repeated requests with wrong keys from one address are blocked for a while.