> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trycontour.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Every request carries your organization's API key as a bearer token.

```
Authorization: Bearer sk_cont_...
```

Create and revoke keys in the Contour dashboard under **Settings → Developers**.
A key is shown once when created.

<Warning>
  Keep the key server-side. Anyone holding it can place calls and read call
  results as your organization.
</Warning>

## Errors

A missing or invalid key returns `401` with a plain-string `detail`:

```json theme={null}
{ "detail": "Invalid or expired API key" }
```

## Rate limit

300 requests per minute per IP. Requests over the limit return `429`.

## Webhooks are different

Requests **we send to you** do not carry your API key. They are authenticated
by an HMAC signature in the `X-Contour-Signature` header instead. See
[Verifying signatures](/webhooks/verifying-signatures).