> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tryvinci.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Use Bearer tokens in the Authorization header on every request.

All Vinci API requests require a Bearer token.

```http title="HTTP Header" theme={"system"}
Authorization: Bearer sk-your-api-key-here
```

Tip
Keep your API key secret. Never expose it in client-side code. Use environment variables or a secure vault.

## Example: Authenticated request

<CodeGroup>
  ```curl cURL theme={"system"}
  curl -X GET "https://tryvinci.com/api/v1/billing/balance" \
    -H "Authorization: Bearer sk-your-api-key-here"
  ```

  ```python authenticated_request.py theme={"system"}
  import requests

  headers = {
    "Authorization": "Bearer sk-your-api-key-here",
    "Content-Type": "application/json",
  }

  r = requests.get("https://tryvinci.com/api/v1/billing/balance", headers=headers)
  r.raise_for_status()
  print(r.json())
  ```

  ```javascript authenticated_request.js theme={"system"}
  const r = await fetch("https://tryvinci.com/api/v1/billing/balance", {
    headers: { "Authorization": "Bearer sk-your-api-key-here" },
  });
  if (!r.ok) throw new Error(`HTTP ${r.status}`);
  console.log(await r.json());
  ```
</CodeGroup>

## Best practices

* Rotate keys periodically and keep separate keys for dev/staging/prod.
* Set rate limits appropriately for each environment.
* Monitor usage and last\_used to detect stale keys.