> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bunny.build/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API key authentication for Bunny security check endpoints

<Tip>
  **API Key**: Your credential for the Bunny API. It identifies your account and authorizes requests. **IMPORTANT**: Without a valid API key, requests will be rejected with `401 Unauthorized`.
</Tip>

## <Icon icon="lock" type="solid" /> How authentication works

All Bunny API endpoints use **API key** authentication only. Include the `X-API-Key` header in every request.

| Header         | Required    | Value                                           |
| -------------- | ----------- | ----------------------------------------------- |
| `X-API-Key`    | Yes         | Your API key (starts with `bun_`)               |
| `Content-Type` | Conditional | `application/json` (required for POST requests) |
| `Accept`       | Recommended | `application/json`                              |

<Card title="Where to send the key" icon="book" horizontal>
  All requests go to the same base URL (`https://api.bunny.build/api/v1`). The environment or plan is determined by the API key you use.
</Card>

<Card title="Authentication errors" icon="warning" horizontal>
  The API returns HTTP `401` when:

  * The API key is missing from the header
  * The key is invalid
  * The key has been revoked
</Card>

## <Icon icon="key" type="solid" /> Getting an API key

1. Sign in to the [Bunny Dashboard](https://app.bunny.build)
2. Complete your profile if prompted
3. Create an API token and copy it. It is shown only once
4. Store the key in a secure place (e.g. environment variables or a secrets manager)

<Card title="Security best practices" icon="light-emergency-on" horizontal>
  * Store keys in environment variables or a secrets manager
  * Never commit API keys to version control or expose them in client-side code
  * Bunny will never ask for your key
  * Revoke any key that may have been compromised
</Card>

## <Icon icon="code" type="solid" /> Examples

```bash theme={null}
# GET request (no Content-Type needed)
curl "https://api.bunny.build/api/v1/temporary-email?email=user@example.com" \
  -H "X-API-Key: bun_your_api_key"

# POST request (Content-Type required)
curl -X POST https://api.bunny.build/api/v1/translate \
  -H "X-API-Key: bun_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"text": "Hello", "from": "en", "to": "pt"}'
```

## Error responses

| Status  | Meaning                                                         |
| ------- | --------------------------------------------------------------- |
| **401** | Missing or invalid API key. Include a valid `X-API-Key` header. |
| **402** | Quota exceeded. Upgrade your plan or wait for the next period.  |
| **403** | Account deactivated. Contact support.                           |