> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pepline.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Bearer secret keys, org-scoped, revocable.

Every request carries your secret key:

```text theme={null}
Authorization: Bearer pep_sk_...
```

* Keys are created in **Settings → API** — create one per integration so each can be revoked on its own. Unlimited keys.
* The full key is shown **once**, at creation. pepline stores only a fingerprint; if you lose a key, create a new one.
* Keys are **organization-scoped**: one key reaches your whole knowledge library, across agents.
* **Revoking** (the archive action in Settings) cuts access immediately. Restoring a revoked key brings the same key back to life — an accidental revocation is recoverable.
* Treat keys like passwords: server-side only, never in frontend code, never in a repository. The widget's publishable key is a different, deliberately public credential — don't confuse the two.

Failures answer `401` with `error.code` of `missing_api_key` or `invalid_api_key` (unknown or revoked).