---
title: "Authentication"
description: "Authenticate with the Edge REST API using API keys."
url: https://edge.network/docs/api/authentication/
---

# Authentication

# Authentication

Every request to the REST API is authenticated with an API key passed as a Bearer token.

## Creating an API Key

- Go to [Account → API Keys](https://account.edge.network/api-keys) in the console
- Click **Create API Key**
- Give it a descriptive name (e.g. "Deploy pipeline — production")
- Copy the key immediately — it is shown only once and stored hashed

Keys start with `ek_live_` and can be
created with an optional expiry (30 days, 90 days, 1 year, or never). Keys can be revoked at any
time; revocation takes effect immediately.

Keys are account-wide

An API key carries full access to the account that created it — treat it like a password.
Never commit keys to version control, and prefer one key per integration so individual
keys can be revoked without breaking everything else.

## Making Authenticated Requests

Pass the key in the `Authorization` header:

```
curl https://edge.network/api/compute/vms \
  -H "Authorization: Bearer ek_live_abc123def456..."
```

A missing, malformed, revoked, or expired key returns `401`:

```
HTTP/1.1 401 Unauthorized

{
  "error": "Invalid or expired API key",
  "code": "AUTHENTICATION_ERROR"
}
```

## Managing Keys via the API

API keys can themselves be managed programmatically (using an existing key or console session):

| Endpoint | Description |
| GET /api/account/keys | List keys — returns name, prefix, last-used, and expiry (never the secret) |
| POST /api/account/keys | Create — `{ name, expiresIn? }` where `expiresIn` is e.g. `30d`, `90d`, `1y`, or `never`. The full secret is returned once. |
| PATCH /api/account/keys/:keyId | Rename a key |
| DELETE /api/account/keys/:keyId | Revoke a key immediately |

## Need Narrower Access?

API keys are all-or-nothing. If you're granting access to an AI agent or third-party tool
and want per-product permissions and spending caps, use an
[Agent Access Code](https://edge.network/docs/agent/access-codes)
(`ea_live_...`) with the
[Agent API](https://edge.network/docs/agent) instead.

| Credential | Prefix | Scope | Used with |
| API key | ek_live_ | Full account access | REST API (`/api/*`), CLI |
| Agent access code | ea_live_ | Per-product permissions, budget caps | Agent API (`/agent/*`) |

[Back to Docs](https://edge.network/docs) [Need help?](https://edge.network/support)