> ## Documentation Index
> Fetch the complete documentation index at: https://growi.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and keys

> Create an API key, pick full or read-only access, and send it with every request.

Every request needs an API key in the `Authorization` header:

```bash theme={"dark"}
Authorization: Bearer growi-sk-YOUR-API-KEY
```

## Create a key

1. In the Growi dashboard, open **Settings → Developer**.
2. Under **API keys**, create a key and choose its access level.
3. Copy the key. Keep it on your server and never put it in a browser or mobile app.

![Developer settings in the Growi dashboard](https://mintcdn.com/growi/UbZ30LH2QFeAIeHu/images/bearer-1.png?fit=max\&auto=format\&n=UbZ30LH2QFeAIeHu\&q=85\&s=3a172d11507924c93f1bc693fea7796f)

Delete a key on the same page to revoke it. It stops working right away.

## Full and viewer keys

| Access level | Can do | Use it for |
| - | - | - |
| **Full** | Every endpoint: reads and writes (`POST`, `PATCH`, `PUT`, `DELETE`) | Your own backend: recording sales, updating creator codes, approving applications |
| **Viewer** | `GET` requests only | Dashboards, BI tools, agencies and anyone who only needs to read |

A viewer key that sends a write gets `403`:

```json theme={"dark"}
{ "error": "This API key is read-only and cannot modify data." }
```

## Which organization a key reads

A key belongs to the organization that created it. If that's a parent organization
with child brands, the key can read every child brand too. See
[child brands](https://growi.mintlify.site/api-reference/child-brands.md).

## Authentication errors

| Status | Body | Why |
| - | - | - |
| `401` | `{ "error": "Not Authenticated" }` | The header is missing, or the key is wrong or deleted |
| `403` | `{ "error": "This API key is read-only and cannot modify data." }` | A viewer key sent a write |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.