> ## Documentation Index
> Fetch the complete documentation index at: https://docs.attesso.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate server-side requests and protect environment-scoped API keys.

Attesso authenticates your backend with an environment-scoped API key in the HTTP `Authorization` header.

```http theme={null}
Authorization: Bearer att_test_...
```

## Keep keys server-side

API keys belong only in your backend's secret store. Never expose them to:

* Browser or mobile application bundles
* End users or AI agents
* Logs, traces, analytics, or error messages
* Source control, issues, or chat
* Command arguments that may be recorded in shell history or process listings

<Warning>
  An Attesso API key represents your organization. Anyone holding it can act through the authenticated server interface within that environment.
</Warning>

## Environments

| Prefix         | Environment | Base URL                          |
| -------------- | ----------- | --------------------------------- |
| `att_test_...` | Staging     | `https://api-staging.attesso.com` |
| `att_live_...` | Production  | `https://api.attesso.com`         |

Use separate secret entries and deployment configuration for each environment. Do not silently fall back from production to staging or the reverse.

## Load a local test key

Read a key without placing it in shell history:

```zsh theme={null}
export ATTESSO_API_URL="https://api-staging.attesso.com"
read -r -s "ATTESSO_API_KEY?Paste your test key: "
export ATTESSO_API_KEY
```

Remove it when the session ends:

```zsh theme={null}
unset ATTESSO_API_KEY
```

## Rotation

Treat the raw key as unrecoverable after initial display.

<Steps>
  <Step title="Create a replacement">
    Store the replacement in your secret manager before changing deployed configuration.
  </Step>

  <Step title="Verify the replacement">
    Make a safe staging request and confirm the expected organization and environment behavior.
  </Step>

  <Step title="Deploy the replacement">
    Update server-side configuration without exposing the value in logs.
  </Step>

  <Step title="Revoke the old key">
    Confirm the replacement is active before removing the historical credential.
  </Step>
</Steps>

A missing or invalid key returns `401`. Treat authentication failures as non-retryable until configuration changes.