# Authentication

Source: https://docs.pipsocket.com/authentication

Your workspace's API key, and rolling it.

Every call carries your workspace's key as a bearer token:

```bash
curl https://api.pipsocket.com/v1/accounts/acc_01m6tx3k9f2qw8r7bznd5yvh4c \
  -H "Authorization: Bearer $PIPSOCKET_KEY"
```

## One key per workspace

- A workspace has one key, and it works for every account in the workspace. An account in another workspace answers `404 no_such_account`, exactly as an account that doesn't exist.
- The key is `psk_` and 43 more characters. It is shown once, when it is made: Pipsocket keeps only its hash and its last four characters.
- Make it on the dashboard's **API key** page. The workspace's owners and admins can make and roll it; members see its last four characters, who made it and when.
- Keep it on your server. The API doesn't answer browsers' cross-origin requests, so a key in a web page wouldn't work anyway.
- A new key works within about a minute, as it reaches every Cloudflare location.
- The key is checked on every REST call, and on a stream once, when it connects.

## Rolling the key

Rolling gives the workspace a new key and retires the current one. On the **API key** page, choose **Roll key** and confirm; the new key is shown once, and the dialog stays open until you tick that you've saved it.

The old key stops working for new requests and new streams within about a minute, so put the new key everywhere the old one was used straight away. If Pipsocket can't retire the old key at once, the page says so and keeps trying every minute: until then the old key may still work.

A stream checks the key only when it connects. A stream opened with the old key stays open, and its calls still work, until it closes. After rolling a key you suspect someone else has, close your own streams and connect them again with the new key; a stream someone else opened stays open until it closes, so engage the [kill switch](/api/kill-switch) if they could trade, and contact support.

## Refusals

| Status | `error` | Meaning |
| --- | --- | --- |
| 401 | `missing_api_key` | No key: send `Authorization: Bearer <key>`. |
| 401 | `invalid_api_key` | Not a workspace's current key (a rolled key stops working within about a minute). |
| 404 | `no_such_account` | No such account, or one your workspace doesn't have. |

The stream takes the key the same way, on its WebSocket upgrade: see [the WebSocket stream](/websocket).