> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thinnest.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Bearer keys, and the one place they must never go.

```
Authorization: Bearer ta_live_…
```

Create a key in **Settings → API keys**. It is shown **once**, at creation, and
stored only as a hash — nothing can retrieve it afterwards, including us.

## This is not your widget key

<Warning>
  Your **public key** (`pk_…`) identifies which agent answers and is meant to be
  visible in your page source.

  Your **API key** (`ta_live_…`) can message any of your customers. It belongs in
  a server's environment. Putting it in your HTML hands anybody the ability to
  message your entire contact list.
</Warning>

## Revoking

Immediate. Revoked keys are kept along with their last-used time, because that
is the first thing anybody wants to know after a leak.

## Rate limits

Per organization, per minute.

```http theme={null}
HTTP/1.1 429 Too Many Requests
Retry-After: 60
```

Honour `Retry-After`. The limit exists because a loop in an integration can
spend a month of WhatsApp budget before anybody looks at a dashboard — and
because Meta rate-limits the number afterwards. The damage is money first and
reputation second.

<Note>
  Idempotency protects you from repeating **one** request. It does nothing about
  a thousand different ones. These are separate problems and both are guarded.
</Note>

## Storing the key

<CodeGroup>
  ```bash Environment theme={null}
  THINNEST_API_KEY=ta_live_xxxxxxxxxxxx
  ```

  ```js Node theme={null}
  const res = await fetch("https://app.thinnest.ai/api/v1/messages", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.THINNEST_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify(payload),
  });
  ```

  ```python Python theme={null}
  import os, requests

  res = requests.post(
      "https://app.thinnest.ai/api/v1/messages",
      headers={"Authorization": f"Bearer {os.environ['THINNEST_API_KEY']}"},
      json=payload,
  )
  ```
</CodeGroup>