# Authentication

Authenticate HTTP API requests with an API key.

Source: https://docs.wavedash.com/api/authentication

Every request needs an API key sent as a bearer token:

```bash
curl "https://api.wavedash.com/api/games/$GAME_ID/leaderboards/by-name/$LEADERBOARD_NAME" \
  -X PATCH \
  -H "Authorization: Bearer $WAVEDASH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"visible": true}'
```

## Creating a key

Create one in the Developer Portal under **API Keys**. The key is shown once — store it in your secret manager immediately.

This is the same key the CLI uses, so if you already set `WAVEDASH_TOKEN` for CI you can reuse it. See [CLI authentication](/cli/authentication).

## Scope

A key acts on your behalf for every game your team can access. There's no per-game or read-only key today, so treat it as a full-access credential:

- Keep it on a server you control. Never ship it in a game build, client-side script, or public repo.
- Use the [SDK](/sdk) for anything running in a player's browser.
- Rotate by creating a new key and deleting the old one in the Developer Portal.

## Failures

| Status | When |
| --- | --- |
| `401` | `unauthorized` — no `Authorization` header, or the key isn't valid. |
| `403` | `forbidden` — the key is valid but your team can't access that game. |