> ## Documentation Index
> Fetch the complete documentation index at: https://developers.usewave.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate Wave API requests using bearer tokens. Learn how to generate, rotate, and safely use your Wave API keys.

The Wave API uses bearer token authentication. Every request must include a valid API key in the `Authorization` header.

## Generate an API key

1. Sign in to the [Wave Dashboard](https://app.usewave.co).
2. Navigate to **Settings > API Keys**.
3. Click **Create API Key** and copy the generated secret. Keys are prefixed with `wave_live_`.

<Warning>
  API keys grant full access to your Wave account. Store them securely and never commit them to source control.
</Warning>

## Authenticate a request

Pass your key in the `Authorization` header as a bearer token:

```bash theme={null}
curl https://api.usewave.co/api/v1/audiences \
  -H "Authorization: Bearer wave_live_your_key_here"
```

## Subscription access

Some endpoints require an active Wave subscription. Requests made with a key belonging to an inactive workspace return `403 Forbidden`. Upgrade your plan in the [Wave Dashboard](https://app.usewave.co) to unlock access.

## Rotate keys

If a key is exposed, revoke it immediately from **Settings > API Keys** and generate a new one. Old keys stop working the moment they are revoked.