> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cotizave.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Use a server-side API key, manage rotation and resolve access errors.

<span id="keys" />

## API keys

Create keys under [API Keys in the dashboard](https://app.cotizave.com). They start with `ctz_live_` and contain 47 characters. The full key is shown once. `ctz_live_...` in this documentation is a placeholder, not a usable key.

<span id="como" />

## Send the credential

```http theme={null}
GET /v1/fx/rates HTTP/1.1
Host: api.cotizave.com
X-API-Key: ctz_live_...
Accept: application/json
```

Read `COTIZAVE_API_KEY` from private server configuration and trim leading and trailing whitespace. Use the [quickstart clients](/en/api/quickstart#paso-2), which reject redirects and check responses. Send the key in the header, never in the URL.

<span id="gestion" />

## Create, rotate and revoke

To replace a key, use dashboard rotation. You can invalidate the previous key during rotation; paid plans also allow a 60-minute overlap while deploying the new one. For a leaked key, choose revocation without overlap. The new key is shown once: update your services before the selected window ends.

Revocation does not allow the key to be recovered or reactivated. Creating multiple keys does not multiply the account’s monthly quota.

<span id="seguridad" />

## Keep the key on the server

Browsers and apps distributed to users must call your backend. Keep the key out of bundles, repositories, error messages, logs and screenshots. Keep TLS verification enabled. An API key and a webhook signing secret are separate credentials.

<span id="respuestas" />

## Access errors

| Status / code | Action |
| - | - |
| `401 invalid_api_key` | Check the key’s presence, format and copied value. |
| `401 key_revoked` | Use an active key. |
| `403 email_not_verified` | Verify your email in the dashboard. |
| `403 account_inactive` | Check account status. |
| `402 feature_not_in_plan` | Check feature or market access. |
| `429 rate_limit_exceeded` | Check scope and waiting instructions in the headers. |

<span id="proximos" />

## Continue

Read about [quotas](/en/api/rate-limits) and [errors](/en/api/errors). Do not repeatedly retry an invalid key: IP protection may also be triggered.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.