# Authentication & keys

> API keys, scopes, expiry and revocation.

Every request authenticates with a bearer key:

<CodeCard caption="HTTP header">

```http
Authorization: Bearer roar_live_...
```

</CodeCard>

Keys are shown once at creation and stored hashed — nobody, including us, can read one back. Treat them like passwords.

## Scopes

A key always carries the `inference` scope (it can call `/v1/*`). Management scopes are opt-in per key, so the same key an app uses for AI calls can also — if you choose — manage resources through the management API:

| Scope | Allows |
| --- | --- |
| `inference` | All `/v1` endpoints (always present) |
| `keys:read` | List keys (never the secrets) |
| `keys:write` | Create and revoke keys |
| `usage:read` | Usage, cost and budget reporting (metadata only — never prompt or response content) |
| `requests:read` | Read a stored call's prompt and response content |
| `apps:read` | List hosted apps and their status |
| `apps:deploy` | Deploy, redeploy and configure hosted apps |
| `projects:write` | Create projects and set project budgets |

A key can never grant a scope it doesn't hold itself, so a leaked low-privilege key can't mint a more powerful one.

## Expiry and revocation

Keys can be created with an expiry (`expiresInDays`); expired keys stop authenticating with `401`. Revocation from the console is immediate. Suspended accounts get `403` on every call.

## Management API

Management endpoints live under `https://api.roar-ai.com/client/*` and accept the same bearer key, gated by the scopes above. The full surface is in the [API reference](/docs/api).