> ## Documentation Index
> Fetch the complete documentation index at: https://rubie.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate Rubie API requests with bearer API keys.

All endpoints use bearer authentication. Create and manage keys in
[Your Rubie dashboard](https://app.rubiehq.com/api-keys).

## Header Format

```bash theme={null}
Authorization: Bearer sk_...
```

If the header is missing or invalid, the API returns `401`.

## Example Request

```bash theme={null}
curl -s "https://app.rubiehq.com/api/v1/credential-sessions/sess_..." \
  -H "Authorization: Bearer $RUBIE_API_KEY"
```

## Base URL

Production base URL: `https://app.rubiehq.com/api/v1`

## What a Key Grants

Keys are scoped to a single Rubie account. Every resource you reference — a
credential, a session, a Blueprint, a run — must belong to that same account, or
the request returns `404` (for resources you can't see) or `403` (for resources
you can see but aren't authorized for).

Blueprints add a second layer: a Blueprint can have specific API keys linked to
it, in which case only those keys may trigger it or read its runs. If no keys are
linked, any valid key on the owning account works. Ask your Rubie contact which
applies to your Blueprint.

## Best Practices

* Never embed API keys in frontend bundles — every endpoint here is server-to-server
* Store keys in your secret manager
* Redact `Authorization` headers from logs