> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sahut.id/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate with the Sahut API

> Generate a Sahut API key and pass it in the Authorization: Bearer header to authenticate all REST API requests made from your integration.

The Sahut API uses **API key authentication**. Every request must include your API key in the `Authorization` header. There are no other authentication methods for the REST API.

## Generate an API key

1. Log in to your Sahut workspace
2. Go to **Settings → Integrations → API Keys**
3. Click **Buat API Key** (Create API Key)
4. Enter a label to identify this key (e.g., "CRM Integration" or "Chatbot")
5. Click **Buat** (Create)
6. Copy the key immediately — Sahut only shows the full key once

<Warning>Store your API key securely. Sahut cannot show you the key again after you close the creation dialog. If you lose it, revoke it and create a new one.</Warning>

## Pass the API key in requests

Include your API key in the `Authorization` header of every request using the `Bearer` scheme:

```bash theme={null}
curl https://api.sahut.id/v1/conversations \
  -H "Authorization: Bearer sk_live_YOUR_API_KEY_HERE"
```

<CodeGroup>
  ```javascript Node.js theme={null}
  const response = await fetch('https://api.sahut.id/v1/conversations', {
    headers: {
      'Authorization': 'Bearer sk_live_YOUR_API_KEY_HERE',
      'Content-Type': 'application/json'
    }
  });
  const data = await response.json();
  ```

  ```python Python theme={null}
  import requests

  headers = {
      'Authorization': 'Bearer sk_live_YOUR_API_KEY_HERE',
      'Content-Type': 'application/json'
  }
  response = requests.get('https://api.sahut.id/v1/conversations', headers=headers)
  data = response.json()
  ```

  ```php PHP theme={null}
  $ch = curl_init('https://api.sahut.id/v1/conversations');
  curl_setopt($ch, CURLOPT_HTTPHEADER, [
      'Authorization: Bearer sk_live_YOUR_API_KEY_HERE',
      'Content-Type: application/json'
  ]);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  $response = json_decode(curl_exec($ch), true);
  ```
</CodeGroup>

## Authentication errors

If your API key is missing or invalid, the API returns:

```json theme={null}
{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key",
    "status": 401
  }
}
```

Common causes:

* **Key not included** — You forgot the `Authorization` header
* **Wrong format** — Use `Bearer YOUR_KEY`, not just `YOUR_KEY`
* **Key revoked** — The key was deleted; generate a new one
* **Wrong workspace** — The key belongs to a different workspace

## Revoking API keys

If an API key is compromised or no longer needed:

1. Go to **Settings → Integrations → API Keys**
2. Find the key by its label
3. Click **Cabut** (Revoke)

Revoking a key is immediate. Any requests using that key will receive a `401 Unauthorized` response.

## Security best practices

* **Never expose API keys in client-side code** — Your API key in front-end JavaScript is visible to anyone who views your page source
* **Use environment variables** — Store keys in `.env` files or your platform's secret manager
* **Create separate keys per integration** — This way you can revoke one key without breaking others
* **Rotate keys periodically** — Especially for keys used in production systems