# Authentication

Create, store, send, and rotate a Micro API key safely.

Micro's public API uses an API key in the `x-api-key` header. Create and revoke keys from [Settings → Developers](https://app.micro.so/settings/api-access).

```http
x-api-key: YOUR_API_KEY
```

Keep keys in a server-side secret store or environment variable, never source control, logs, URLs, or a public browser bundle. The workspace ID appears on the same page and is not secret.

Use `https://developers.micro.so` as the base URL. A missing or invalid key returns `401`. A valid key without access to a team or resource returns `403`.

Rotate a key by creating a replacement, updating consumers, confirming they work, then deleting the old key. Never send a key to support; send the response's `x-request-id` instead.