> ## Documentation Index
> Fetch the complete documentation index at: https://docs.square1.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, the Bearer header, and account states

Every `/v1` endpoint authenticates with an API key sent as a Bearer token:

```text theme={null}
Authorization: Bearer sq-arca-...
```

There is no other authentication for the API surface — no query-string
keys, no cookies. (The dashboard uses its own cookie session; that surface
is separate from this API and not covered here.)

## Keys

* **Format** — new keys are prefixed `sq-arca-`. Older `ws-` keys remain
  fully valid; the dashboard marks them `LEGACY`.
* **Storage** — keys are shown once at creation and stored hashed.
  Recently created keys can be re-revealed from the dashboard; older ones
  cannot, so treat every key as show-once.
* **Multiple keys** — an account can hold several labeled keys (for
  example one per app). All keys share the same account-level quota.
* **Rotation** — rotating from the dashboard revokes the old key and
  issues a new one in a single step.

<Warning>
  A key identifies your community account. Don't embed it in client-side
  code or share it — anyone holding the key spends **your** quota.
</Warning>

## Account states

A syntactically valid key can still be refused when the account behind it
is not in good standing:

| HTTP | `code`                            | Meaning                                                   | What to do                                   |
| ---- | --------------------------------- | --------------------------------------------------------- | -------------------------------------------- |
| 401  | `invalid_api_key`                 | Key unknown, malformed, or revoked                        | Create a new key in the dashboard            |
| 403  | `account_unlinked`                | Community re-verification required                        | Sign in to the dashboard and re-verify       |
| 403  | `legacy_account_upgrade_required` | Pre-account-system key whose account hasn't been upgraded | Complete the upgrade wizard in the dashboard |
| 403  | `guest_expired`                   | Guest access window ended                                 | Contact the operator                         |
| 403  | `email_required`                  | Email registration is enforced and this account has none  | Register an email in the dashboard settings  |
| 403  | `geo_restricted`                  | Request came from outside the allowed region              | —                                            |

`GET /v1/me` is the cheapest way to check that a key works and see which
account (and key label) it maps to.