---
title: Authentication
description: Authenticate workspace API requests with a Bearer API key
group: Guides
---

# Authentication

# Authentication

Workspace endpoints require a workspace API key in the `Authorization` header:

```http
Authorization: Bearer vc_...
```

Keys are created in the dashboard at [app.verifycate.com](https://app.verifycate.com) (Workspace → API Keys). The secret starts with `vc_` and is shown only once when created.

## Requirements

- The key must belong to the workspace in the path (`/workspaces/{slug}/...`).
- The workspace must have an active Pro seat. Unseated keys are rejected with `402` and code `seat_required`.
- Scopes on the key must allow the method and path — see [Scopes](/docs/api/scopes).

## What not to use

Do **not** send dashboard session cookies or user JWT access tokens for these workspace API routes. The developer API is keyed authentication only.

## Public endpoints

These routes need no `Authorization` header:

- `GET /api/v1/certificates/{publicID}`
- `GET /api/v1/certificates/{publicID}/verify`
- `GET /api/v1/certificates/{publicID}/credential.json`

See [Verify](/docs/api/verify/get-public).