> ## Documentation Index
> Fetch the complete documentation index at: https://docs.support.onclarity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Your organization API key: how to get one, how to send it, and how to keep it safe.

Every request to the Voice API and the Support API carries your **organization API key** as a bearer token:

```bash theme={null}
curl https://voice-api.onclarity.com/v1/projects \
  -H "Authorization: Bearer $CLARITY_API_KEY"
```

Keys start with `anek_org_`. A key belongs to one organization and reaches only that organization's data: its projects, agents, and calls on the Voice API, and its tickets, customers, and settings on the Support API. The same key works on both.

## Getting a key

API keys are issued by Clarity. Ask your Clarity contact, or email [hello@onclarity.com](mailto:hello@onclarity.com), and say what the key is for. Each key gets its own label, so one integration's key can be revoked or replaced without touching the others.

> [!WARNING]
>
> The full key is shown once, when it is created. Store it straight away in a secret manager or an environment variable. Clarity can't show it again, only issue a new one.

## What a key can do

A key acts for the organization as a whole, with the access of a business user. It can read and change configuration, publish voice agents, and place calls. A few actions need a signed-in person in the Clarity app and refuse an API key, with a `403`:

* Listening to, joining, steering, or hanging up a live call.
* Claiming calls as a Voice Assist operator.
* Creating or revoking API keys.

## Expiry, rotation, and revocation

| | |
| - | - |
| Expiry | None by default. A key can be issued with an expiry of 1 to 365 days. |
| Rotation | Clarity reissues the key under the same label. The old key either stops at once, after a leak, or keeps working for 24 hours while you deploy the new one. |
| Revocation | A revoked key is refused by both APIs within one minute. |

## Keeping keys safe

* Keep keys on your servers. Never ship one in a web page, a mobile app, or source control. The chat widget and the mobile SDKs use their own public identifiers instead (see [SDKs](/sdks/overview.md)).
* Give each integration its own key, so you can revoke one without breaking the rest.
* If a key leaks, contact Clarity to revoke it at once.

## Errors

| Status | Meaning |
| - | - |
| `401` | The `Authorization` header is missing, or the key is unknown, expired, or revoked. |
| `403` | The key is valid but the action needs a signed-in person, or the resource belongs to another organization. |

See [Errors](/api-reference/errors.md) for the full list.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.