# Authentication

Canonical: https://monsterapi.co/docs/authentication

Create an API key in the [customer account](https://monsterapi.co/account/api-keys).
Give the key a name that identifies its application. When the secret appears, copy it. The account does not display it again.

Each API request uses the key in this header:

```text
Authorization: Bearer YOUR_API_KEY
```

Store the key on your server or in a secret store. Do not put it in public source code, page markup, or a mobile application.
If a key is exposed or lost, revoke it in the account. Then create another key.
Account sign-in and API keys serve separate purposes. An API key does not sign you into the account.

## Try a request

Open an operation in the [API reference](https://monsterapi.co/docs/api). Read its current credit price.
Select **API key** to open the dialog. Enter your key in the masked field. Select **Save key**.
After a save, the control shows **API key saved**. **Change key** opens the field for a replacement key.

The browser saves the key across operations, platforms, guides, and page reloads. Closing the tab does not clear the key.
To delete the saved key, open **API key saved**. Select **Clear key**.
Copied request examples contain `YOUR_API_KEY`, not your secret.

If browser storage blocks the save, the portal keeps the key only until a reload or tab closure. A notice explains this limit.
If **Clear key** cannot delete the saved copy, the portal shows a warning. It clears the active key, but the saved copy can remain.
Before a reload, use the browser settings to delete the stored key for this site.

Example selection does not spend credits. **Prepare example** can send prerequisite requests after an explicit click.
Read the displayed price before preparation or the final request. Each prerequisite and each page is a separate request.

## Gateway refusals

The gateway checks authorization before a request reaches a platform. Gateway refusals are not charged.

| Status and code         | Action                                                                  |
| ----------------------- | ----------------------------------------------------------------------- |
| `401 unauthorized`      | Send the complete bearer key with the required format.                  |
| `402 payment_required`  | Read the current price and available credits in the account.            |
| `403 forbidden`         | Make sure that the key is active. If it is revoked, create another key. |
| `429 too_many_requests` | Wait for `Retry-After` before another request.                          |

Read [Errors](https://monsterapi.co/docs/errors) for response bodies and [Pricing](https://monsterapi.co/docs/pricing) for charge and refund rules.