> ## Documentation Index
> Fetch the complete documentation index at: https://docs.surge.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create and manage API keys, authenticate with a Bearer token, scope account requests, and view API logs.

Every Surge API request requires an API key. Pass it as a Bearer token. Keys are scoped to a project, and account-specific resources are addressed by the account ID in the request path.

## Create and manage API keys

All requests to the Surge API require an API key. You create and manage keys in the dashboard under the **API Keys** section.

There are two key types:

| Key prefix    | Type | Use                                             |
| ------------- | ---- | ----------------------------------------------- |
| `sk_live_...` | Live | Production API calls                            |
| `sk_demo_...` | Demo | Basic evaluation against the shared demo number |

Demo keys are limited to sends through the shared demo number. They have no other capabilities and shouldn't be used beyond basic evaluation of Surge. Surge is likely to deprecate demo keys in the future in favor of sandboxes.

## Authenticate with a Bearer token

Pass your API key as a bearer token in the `Authorization` header:

```http theme={null}
Authorization: Bearer sk_live_your_api_key_here
```

<Warning>
  All requests must use HTTPS. Plaintext HTTP requests are rejected.
</Warning>

## Scope requests to an account

API keys are scoped to a **project**: they can access all accounts under that project. Account-specific resources are scoped by the account ID in the request path:

```
GET /accounts/acct_01jrzhe8d9enptypyx360pcmxj/messages
POST /accounts/acct_01jrzhe8d9enptypyx360pcmxj/messages
```

A single project API key can create and manage multiple accounts, send messages from any of them, and read data across all of them.

## Authentication errors

| Error             | HTTP status | Cause                                                |
| ----------------- | ----------- | ---------------------------------------------------- |
| `missing_api_key` | 401         | No `Authorization` header                            |
| `invalid_api_key` | 401         | Key not found or revoked                             |
| `demo_api_key`    | 403         | Demo key used for an action that requires a live key |
| `platform_locked` | 403         | Your project has been locked                         |

## View API request logs

All authenticated API requests are logged. You can view them in the dashboard under the **API Logs** section. Logs include the method, path, response status, and response time for each request.