> ## Documentation Index
> Fetch the complete documentation index at: https://docs.civiccontracts.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create org-scoped API keys and authenticate requests to the Civic AI product API.

## API keys

Civic AI API keys are **scoped to your organization**, not to an individual user. Any request made with a key acts on your org's data (pipelines, pursuits) with the identity of the admin who created the key.

### Creating a key

1. Sign in to [civiccontracts.com](https://www.civiccontracts.com) as an **org admin**.
2. Go to [Settings → Organization](https://www.civiccontracts.com/settings/org) and open the **API keys** tab.
3. Click **Create API key**, give it a name (e.g. "Zapier integration"), and copy the key.

<Warning>
  The full key (`civic_…`) is shown **exactly once** at creation. Store it in a secrets manager — only the short prefix is visible afterwards.
</Warning>

### Using a key

Pass the key on every request, either as a Bearer token:

```bash theme={null}
curl -H "Authorization: Bearer civic_YOUR_API_KEY" \
  "https://api.civiccontracts.com/v1/contracts/search?q=janitorial+services"
```

or via the `X-API-Key` header:

```bash theme={null}
curl -H "X-API-Key: civic_YOUR_API_KEY" \
  "https://api.civiccontracts.com/v1/awards/search?q=lockheed&state=TX"
```

### Revoking a key

Admins can revoke a key from the same **API keys** tab. Revocation is immediate and permanent — requests with a revoked key return `401`.

## Errors

| Status | Meaning                                       |
| ------ | --------------------------------------------- |
| `401`  | Missing, invalid, or revoked API key          |
| `400`  | Invalid input (message in `error`)            |
| `404`  | Resource not found or not visible to your org |
| `429`  | Rate limit exceeded — back off and retry      |

```json theme={null}
{ "success": false, "error": "Invalid or revoked API key" }
```

## Rate limits

Requests are limited **per key** (currently 120 requests/minute). Standard `RateLimit-*` headers are included on every response. Contact **[info@civiccontracts.com](mailto:info@civiccontracts.com)** for higher throughput.