> ## Documentation Index
> Fetch the complete documentation index at: https://docs.writerzroom.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Authentication

> How to authenticate API requests and manage access safely.

WriterzRoom API requests use Bearer token authentication.

API keys are generated from the product settings area on supported plans and supplied in the `Authorization` header for each request.

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
Authorization: Bearer YOUR_API_KEY
```

## Authentication Overview

<div style={{ display: 'grid', gridTemplateColumns: 'repeat(4, 1fr)', gap: '12px', margin: '1.5rem 0' }}>
  <div style={{ border: '1px solid rgba(128,128,128,0.20)', borderRadius: '14px', padding: '16px', background: 'rgba(255,255,255,0.04)' }}>
    <div style={{ fontWeight: 800 }}>Authenticate</div>
    <div style={{ fontSize: '13px', color: 'var(--colors-content-secondary)' }}>Send a Bearer token with every protected request.</div>
  </div>

  <div style={{ border: '1px solid rgba(128,128,128,0.20)', borderRadius: '14px', padding: '16px', background: 'rgba(255,255,255,0.04)' }}>
    <div style={{ fontWeight: 800 }}>Protect</div>
    <div style={{ fontSize: '13px', color: 'var(--colors-content-secondary)' }}>Store keys in secure server-side environments.</div>
  </div>

  <div style={{ border: '1px solid rgba(128,128,128,0.20)', borderRadius: '14px', padding: '16px', background: 'rgba(255,255,255,0.04)' }}>
    <div style={{ fontWeight: 800 }}>Rotate</div>
    <div style={{ fontSize: '13px', color: 'var(--colors-content-secondary)' }}>Replace keys after exposure or access changes.</div>
  </div>

  <div style={{ border: '1px solid rgba(128,128,128,0.20)', borderRadius: '14px', padding: '16px', background: 'rgba(255,255,255,0.04)' }}>
    <div style={{ fontWeight: 800 }}>Audit</div>
    <div style={{ fontSize: '13px', color: 'var(--colors-content-secondary)' }}>Track usage through generation and content records.</div>
  </div>
</div>

## When Authentication Applies

API authentication is required for integrations that create content, check generation status, retrieve saved content, or access account-level configuration programmatically.

<CardGroup cols={3}>
  <Card title="Applications" icon="app-window">
    Embed WriterzRoom generation inside products, portals, dashboards, and internal tools.
  </Card>

  <Card title="Automation" icon="workflow">
    Connect structured content workflows to editorial systems, campaign operations, and backend jobs.
  </Card>

  <Card title="Enterprise Operations" icon="building-2">
    Support governed content workflows where access control, usage tracking, and auditability matter.
  </Card>
</CardGroup>

## Request Header

Every authenticated request should include these headers.

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json
```

## Example Request

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl -X POST https://api.writerzroom.com/v1/generate \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "template_id": "blog_article_generator",
    "style_profile_id": "general_blog",
    "generation_mode": "standard",
    "vertical_id": "saas_tech",
    "user_input": {
      "topic": "The future of AI in content marketing",
      "target_audience": "Marketing directors at B2B SaaS companies",
      "objective": "Educate on practical AI adoption strategies"
    }
  }'
```

## Authentication Flow

<Steps>
  <Step title="Generate an API key">
    Go to **Settings → API Access** and create a new API key for your integration.
  </Step>

  <Step title="Copy the key once">
    Copy the key immediately. For security, it may not be shown again after creation.
  </Step>

  <Step title="Store it securely">
    Save the key in an environment variable, deployment secret, or managed secrets service.
  </Step>

  <Step title="Send the Bearer token">
    Add the key to every API request using the `Authorization` header.
  </Step>
</Steps>

## Key Management Guidance

| Practice          | Guidance                                                                |
| ----------------- | ----------------------------------------------------------------------- |
| Storage           | Use environment variables, deployment secrets, or managed secret stores |
| Client exposure   | Do not expose API keys in frontend code                                 |
| Repository safety | Do not commit API keys to source control                                |
| Rotation          | Rotate keys after suspected exposure or integration changes             |
| Ownership         | Assign keys to controlled service environments where possible           |

## Operational Guidance

<AccordionGroup>
  <Accordion title="Where should API keys be stored?">
    Store API keys in environment variables, deployment secrets, or a managed secrets service. Do not hardcode keys in application source code.
  </Accordion>

  <Accordion title="Can API keys be used in frontend code?">
    No. API keys should only be used from trusted backend services. Frontend applications should call your backend, and your backend should call WriterzRoom.
  </Accordion>

  <Accordion title="When should keys be rotated?">
    Rotate keys after suspected exposure, employee offboarding, vendor changes, access policy changes, or integration cleanup.
  </Accordion>

  <Accordion title="What causes authentication failure?">
    Authentication can fail when the key is missing, expired, malformed, invalid, sent without the `Bearer` prefix, or used from a plan that does not include API access.
  </Accordion>
</AccordionGroup>

<Warning>
  Do not send API keys in query parameters. Always use the `Authorization` header.
</Warning>

<CardGroup cols={2}>
  <Card title="Generate Content" icon="wand-sparkles" href="/api/generate-content">
    Submit a generation request through the API.
  </Card>

  <Card title="Endpoints Reference" icon="route" href="/api/endpoints">
    Review available API endpoints and expected responses.
  </Card>
</CardGroup>