> ## Documentation Index
> Fetch the complete documentation index at: https://docs.leaf7.fun/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate with the Leaf7 API using your vendor API key.

# Authentication

Every API request must include your **API key** in the `Authorization` header.

## API Base URL

All requests must be sent to the secure Bodyguard proxy:

`https://api.leaf7.fun`

<Warning>
  Direct access to `auth.leaf7.fun` is strictly prohibited and will result in a `403 Forbidden` error.
</Warning>

## Finding your API key

1. Log in to your [Leaf7 Dashboard](https://leaf7.fun/dashboard)
2. Navigate to **Settings**
3. Your API key is displayed under **API Key**

<Note>
  **Automated Key Rotation**: For security, your API key is automatically rotated every **7 days**. You will receive an email warning 24 hours before rotation, and a confirmation email with your new key once rotated. Your old key remains valid for a **24-hour grace period** after rotation.
</Note>

<Warning>
  Keep your API key secret. Anyone with your key has full access to your projects, keys, and source code. **Never** expose it in client-side code, public repositories, or Discord messages.
</Warning>

## Using your API key

Include your API key as a Bearer token in the `Authorization` header of every request.

<Tip>
  Always include a **trailing slash** at the end of your API endpoints (e.g., `/projects/` instead of `/projects`) to ensure optimal performance and avoid redirect overhead.
</Tip>

<CodeGroup>
  ```bash bash theme={null}
  curl -X GET https://api.leaf7.fun/api/vendor/projects/ \
    -H "Authorization: Bearer YOUR_API_KEY" \
    -H "Content-Type: application/json"
  ```

  ```cmd cmd theme={null}
  curl -X GET "https://api.leaf7.fun/api/vendor/projects/" ^
   -H "Authorization: Bearer YOUR_API_KEY" ^
   -H "Content-Type: application/json"
  ```
</CodeGroup>

<CodeGroup>
  ```python Python theme={null}
  import requests

  API_KEY = "your-api-key-here"
  BASE_URL = "https://api.leaf7.fun"

  headers = {
      "Authorization": f"Bearer {API_KEY}",
      "Content-Type": "application/json"
  }

  # Note the trailing slash at the end of the URL
  response = requests.get(f"{BASE_URL}/api/vendor/projects/", headers=headers)
  print(response.json())
  ```

  ```javascript JavaScript theme={null}
  const API_KEY = "your-api-key-here";
  const BASE_URL = "https://api.leaf7.fun";

  const response = await fetch(`${BASE_URL}/api/vendor/projects/`, {
      headers: {
          "Authorization": `Bearer ${API_KEY}`,
          "Content-Type": "application/json"
      }
  });

  const data = await response.json();
  console.log(data);
  ```

  ```lua Lua (Roblox) theme={null}
  local HttpService = game:GetService("HttpService")

  local API_KEY = "your-api-key-here"
  local BASE_URL = "https://api.leaf7.fun"

  local response = request({
      Url = BASE_URL .. "/api/vendor/projects/", -- Added trailing slash
      Method = "GET",
      Headers = {
          ["Authorization"] = "Bearer " .. API_KEY,
          ["Content-Type"] = "application/json"
      }
  })

  print(HttpService:JSONDecode(response.Body))
  ```
</CodeGroup>

## Error responses

If your API key is missing or invalid, you'll receive:

```json theme={null}
{
    "detail": "Not authenticated"
}
```

with HTTP status code `401` or `403`.

## Rate limits

| Scope          | Limit       | Window     |
| -------------- | ----------- | ---------- |
| Global         | 60 requests | Per minute |
| Key generation | 30 requests | Per minute |
| Webhook relay  | 30 requests | Per minute |

Exceeding rate limits returns a `429 Too Many Requests` response. Back off and retry after the window resets.