> ## Documentation Index
> Fetch the complete documentation index at: https://docs.yir.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create a Yir API key and authenticate every Gateway request with a Bearer header.

Every public Gateway request requires a Yir API key in the standard HTTP Bearer header.

## Get your default key

Open [Yir Console](https://console.yir.ai/api-keys). Every account has a default API key bound to its default compute route, so you can start without creating or configuring another key.

The Console hides the full secret by default. You can reveal and copy it again after confirming your identity. Create additional keys when you need separate application, environment, or statistics boundaries.

Store the key in your secret manager or local environment:

```bash theme={null}
export YIR_API_KEY="your-yir-api-key"
```

Send it on every request:

```http theme={null}
Authorization: Bearer $YIR_API_KEY
```

## Key safety

* Never put the key in browser source code, a public repository, a URL, or a client-visible error.
* Use separate keys for production, CI, and local development so each can be revoked independently.
* Rotate a key in Console if it may have been exposed. Rotation preserves the key identity and compute-route binding while immediately invalidating the old secret.
* The default key cannot be revoked. Additional keys can be revoked independently.
* Do not send a KIE, APIMart, or other upstream provider key. Yir does not accept or forward one from client requests.

Use `Authorization`, not `X-API-Key`. Requests without a valid Yir Bearer key are rejected before a task is admitted.