> ## Documentation Index
> Fetch the complete documentation index at: https://docs.atom14.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys & Authentication

> Secure your API access with keys and sandbox testing.

## API Key Types

SearchAnything uses two types of API keys:

### Live Keys (`sk_live_...`)

Production keys that:

* Process real files
* Count against your quota
* Store data permanently
* Should be kept secret

### Test Keys (`sk_test_...`)

Sandbox keys that:

* Return mock data instantly
* Don't count against quota
* Don't process or store files
* Safe to use in public code

<Warning>
  Never commit live keys to version control or expose them in client-side code. Always use environment variables.
</Warning>

## Creating an API Key

1. Log in to your [Dashboard](https://atom14.ai/dashboard.html)
2. Click **Developers** in the navigation
3. Click **Create New Key**
4. Choose **Live** or **Test** environment
5. Copy your key immediately (you won't see it again!)

## Authentication

All API requests require authentication via the `Authorization` header:

```bash theme={null}
curl -X GET https://searchanything.onrender.com/api/search?q=test \
  -H "Authorization: Bearer sk_live_YOUR_KEY_HERE"
```

### Sandbox Mode (Test Keys)

Test keys provide realistic responses without processing real files:

```bash theme={null}
curl -X POST https://searchanything.onrender.com/api/files/upload \
  -H "Authorization: Bearer sk_test_abc123" \
  -F "file=@document.pdf"
```

**Response** (instant mock):

```json theme={null}
{
  "file": {
    "id": "mock-file-id",
    "original_name": "document.pdf",
    "status": "ready",
    "sandbox": true
  }
}
```

## Security Best Practices

<AccordionGroup>
  <Accordion title="Rotate keys regularly">
    Create new keys every 90 days and revoke old ones.
  </Accordion>

  <Accordion title="Use environment variables">
    Never hardcode keys in your source code:

    ```python theme={null}
    import os
    API_KEY = os.environ['SEARCHANYTHING_API_KEY']
    ```
  </Accordion>

  <Accordion title="Separate keys per environment">
    Use different keys for development, staging, and production.
  </Accordion>

  <Accordion title="Monitor key usage">
    Check your Developer Dashboard regularly for suspicious activity.
  </Accordion>
</AccordionGroup>

## Key Management

### List Your Keys

View all active keys in the Developer Dashboard. Keys are displayed with:

* Key name
* Prefix (e.g., `sk_live_...`)
* Creation date
* Type (Live or Test)

### Revoke a Key

Deleting a key immediately invalidates it. Any applications using that key will receive 401 errors.

<Warning>
  Revoking a key cannot be undone. Make sure to update your applications before revoking production keys.
</Warning>

## Rate Limits

All API endpoints are rate-limited to prevent abuse:

| Plan       | Requests per Second |
| ---------- | ------------------- |
| Free       | 5 req/s             |
| Pro        | 50 req/s            |
| Enterprise | Custom              |

If you exceed your rate limit, you'll receive a `429 Too Many Requests` response.