> ## Documentation Index
> Fetch the complete documentation index at: https://apidocs.eraus.gg/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Keys, scopes and where to put them.

Send your key in the `Authorization` header on every request:

```http theme={null}
Authorization: Bearer era_k3j9x0abq2mn_bhnbacATvnxO31TPngj7QtIO-L5123-XKU9VTGMcnqU
```

`X-Api-Key: <key>` and ER:LC's `Server-Key: <key>` also work.

## Key format

```
era_<server id>_<secret>
```

The server id says which private server the key belongs to. The secret is 256 bits of randomness. ERA stores only a salted hash of it, so nobody can read your key back, not even ERA staff. Anyone with the key can use it, so treat it like a password.

## Scopes

| Scope | Lets the key |
| - | - |
| `read` | Read server info, players, staff, teams, vehicles, bans, logs and events. Every key has this. |
| `commands` | Run [approved commands](https://apidocs.eraus.gg/commands.md). Choose it when you make the key. |

A key's scopes can't change. To give a tool more access, make a new key and revoke the old one.

## Check a key

[`GET /v1/me`](https://apidocs.eraus.gg/api/me) returns the key's name, its scopes and which server it belongs to. Use it as a "test connection" button.

## Keep keys safe

* Only call the API from a server, never from a browser or a Discord client. The API sends no CORS headers on purpose.
* Give each tool its own key. Then you can revoke one without breaking the others.
* A server can have up to 5 keys. Only the server owner can make or revoke them, from the in-server console.
* Repeated bad keys from the same IP get rate limited.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.