> ## Documentation Index
> Fetch the complete documentation index at: https://docs.concatflow.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> A secret API key, as a bearer token, from your server only.

```bash cURL theme={"system"}
curl https://app.concatflow.com/api/v1/embed/sessions \
  -H "Authorization: Bearer $CONCATFLOW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "assistant_id": "YOUR_ASSISTANT_ID",
    "partitions": { "customer_id": "4712" }
  }'
```

```ts Node theme={"system"}
import { Concatflow } from "@concatflow/node";

const concatflow = new Concatflow({ apiKey: process.env.CONCATFLOW_API_KEY! });
```

```json 401 theme={"system"}
{ "error": "invalid_api_key" }
```

Every request carries your API key in the `Authorization` header:

```http theme={"system"}
Authorization: Bearer lyra_sk_...
```

Create keys in **Settings → Developers → API keys**. A key starts with `lyra_sk_` and belongs to one workspace: it reaches that workspace's assistants only. The dashboard shows the secret once, when you create the key.

## Keep the key on your server

The key opens sessions for **any** customer. Anyone who has it can read your customers' answers.

* Store it in an environment variable, never in the repository.
* Never send it to a browser or a mobile app. `@concatflow/node` refuses to run in a browser.
* If a key leaks, revoke it in the dashboard and create another. A revoked key fails at once with `401 invalid_api_key`.

The key is checked before anything else: a request with a missing or wrong key always gets `401`, whatever else is wrong with it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.