> ## Documentation Index
> Fetch the complete documentation index at: https://boltcall.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate your requests to the Boltcall REST API using API keys.

All requests to the Boltcall API must include a valid API key. The API uses Bearer token authentication — pass your key in the `Authorization` header on every request.

**Base URL**

```
https://api.boltcall.org/v1
```

## Get an API key

Generate API keys from your dashboard under **Settings → API Keys**. See [API keys](/account/api-keys) for instructions on creating and managing keys.

## Send authenticated requests

Include your API key as a Bearer token in the `Authorization` header:

<CodeGroup>
  ```bash cURL theme={null}
  curl https://api.boltcall.org/v1/agents \
    -H "Authorization: Bearer YOUR_API_KEY" \
    -H "Content-Type: application/json"
  ```

  ```javascript Node.js theme={null}
  const response = await fetch('https://api.boltcall.org/v1/agents', {
    headers: {
      'Authorization': 'Bearer YOUR_API_KEY',
      'Content-Type': 'application/json',
    },
  });
  const data = await response.json();
  ```

  ```python Python theme={null}
  import requests

  response = requests.get(
      'https://api.boltcall.org/v1/agents',
      headers={
          'Authorization': 'Bearer YOUR_API_KEY',
          'Content-Type': 'application/json',
      },
  )
  data = response.json()
  ```
</CodeGroup>

<Warning>
  Never expose API keys in client-side code or public repositories. Store them in environment variables and make API calls from your server.
</Warning>

## Key permissions

When creating an API key you choose which resources it can access and whether each resource allows `read` or `write` access. Available resources are: `calls`, `leads`, `agents`, `analytics`, `contacts`, `knowledge_base`, and `integrations`.

## Error responses

### 401 Unauthorized

Returned when the `Authorization` header is missing or the key is invalid or expired.

```json theme={null}
{
  "error": {
    "code": "invalid_api_key",
    "message": "The API key provided is invalid or expired.",
    "status": 401
  }
}
```

### 403 Forbidden

Returned when the key is valid but lacks the required permission for the requested resource.

```json theme={null}
{
  "error": {
    "code": "forbidden",
    "message": "Your API key does not have permission to access this resource.",
    "status": 403
  }
}
```

<Tip>
  If you receive a 403, check the key's permission settings in **Settings → API Keys** and ensure the resource and permission level (`read` or `write`) are enabled.
</Tip>