> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nowadays.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate Nowadays REST API requests with an API key.

The REST API authenticates with an API key.

## API keys

Every request must include your API key in the `x-api-key` header:

```bash theme={null}
curl "https://api.nowadays.ai/v1/events" \
  -H "x-api-key: YOUR_API_KEY"
```

## What a key can reach

A key is issued **to a person**, within one organization. It acts as that person:
every request reaches exactly the events its owner can open in Nowadays, and
nothing else.

That matters for two reasons:

* Events are private to their creator and their approvers by default,
  so a key does not see every event in the organization — only its owner's.
* Events created through the API are **owned by the key's user**, and their
  visibility follows that person's group memberships, exactly as if they had
  created the event in the dashboard.

If you need an integration that spans several people's events, issue a key to a
user who has been granted access to them.

Keys are issued by the Nowadays team; [contact us](mailto:support@nowadays.ai)
to obtain one.

A missing or invalid key returns `401 Unauthorized`. See [Errors](/api/errors)
for the full status-code reference.

## Keeping keys safe

<Warning>
  Treat your key like a password. It is shown only once at creation, and it can
  read **and modify** its owner's events — including creating new ones.
</Warning>

* Store the key in a secret manager or environment variable — never commit it to
  source control or expose it in client-side code.
* Rotate by requesting a new key and revoking the old one; revocation takes
  effect immediately.