---
title: API authentication
description: Create and use a site-scoped Radiant API key.
---

Radiant API requests use site-scoped bearer keys. A key can trigger deployments
and retrieve deployment status for the site where it was created. It cannot
access another documentation site in the same organization.

## Create an API key

Organization owners can create keys from **Dashboard > API keys**.
Give the key a name that identifies its caller, such as `Production CI`.

Radiant displays the complete key once. Copy it immediately and store it as a
secret in your CI provider or server environment.

<Callout type="warning" title="Keep API keys on the server">
  Do not include a Radiant API key in browser JavaScript, a public repository,
  or client-side environment variables.
</Callout>

## Authenticate a request

Send the key in the `Authorization` header using the Bearer scheme:

```bash
curl https://radiantdocs.com/v1/deployments/DEPLOYMENT_ID \
  -H "Authorization: Bearer $RADIANT_API_KEY"
```

Missing, invalid, expired, and deleted keys return `401 Unauthorized`. Requests
for a site or deployment outside the key's site scope return `404 Not Found`.

## Rotate or delete a key

Create a replacement key, update the caller, verify that it works, and then
delete the old key from **Dashboard > API keys**. Deletion is permanent, and the
key stops authenticating requests immediately.

Radiant stores only a cryptographic hash of each key and cannot show the full
value again after the creation dialog closes.

## Next steps

<Columns columns={2}>
  <Column>

<Card title="Create a deployment" href="POST /v1/deployments">
  Start a deployment from the configured branch.
</Card>

  </Column>
  <Column>

<Card title="Get a deployment" href="GET /v1/deployments/{deploymentId}">
  Poll a deployment until it reaches a terminal status.
</Card>

  </Column>
</Columns>