> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sixtyfour.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate Sixtyfour API requests with an API key or an OAuth access token.

Every request authenticates with an API key in the `x-api-key` header or an OAuth access token in the `Authorization` header. Both act for one team in your organization.

| Credential | Format | Header | Get one |
| - | - | - | - |
| API key | Starts with `api_` | `x-api-key: YOUR_API_KEY` | [Get an API Key](https://docs.sixtyfour.ai/get-api-key.md) |
| OAuth access token | Opaque string that starts with `s4at_` | `Authorization: Bearer YOUR_ACCESS_TOKEN` | [Using OAuth Clients](https://docs.sixtyfour.ai/guides/oauth-clients.md) |

## API keys

```bash cURL theme={null}
curl "https://api.sixtyfour.ai/check-balance" \
  -H "x-api-key: YOUR_API_KEY"
```

```python Python theme={null}
import os
import requests

response = requests.get(
    "https://api.sixtyfour.ai/check-balance",
    headers={"x-api-key": os.environ["SIXTYFOUR_API_KEY"]},
)
response.raise_for_status()
print(response.json())
```

```javascript JavaScript theme={null}
const response = await fetch("https://api.sixtyfour.ai/check-balance", {
  headers: { "x-api-key": process.env.SIXTYFOUR_API_KEY },
});
console.log(await response.json());
```

```json Response theme={null}
{
  "credits": 1250.5
}
```

A key belongs to the team it was created in. Requests made with it see that team's workflows, runs and monitors, and count toward that team's monthly spend limit.

## OAuth access tokens

An OAuth client exchanges a signed assertion for an access token at `POST /oauth/token`, then sends the token as a Bearer token:

```bash theme={null}
curl "https://api.sixtyfour.ai/check-balance" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
```

Treat the token as opaque: do not parse it or rely on its contents. It expires after the `expires_in` seconds given in the token response. OAuth tokens work on every endpoint that accepts an API key. An OAuth client acts for your organization's first team, with the same team rules as a key.

## How the API picks a credential

* A request with `Authorization: Bearer` is authenticated with that token. The API ignores `x-api-key` on that request, even when the token is invalid.
* An API key sent as a Bearer token is refused with `401` (`Invalid bearer token` or `Invalid token`, depending on the endpoint). Send API keys only in `x-api-key`.
* Send one credential per request.

For every `401` message, see [401 Unauthorized](https://docs.sixtyfour.ai/api-reference/errors.md#401-unauthorized).

## Endpoints without credentials

| Endpoint | Behavior |
| - | - |
| `GET /templates`, `GET /templates/{template_key}` | Public catalog. A credential you do send must be valid |
| `GET /v1/media/{token}` | Media URLs from enrichment results. Organizations with customer-managed encryption must send their API key |
| `GET /v1/media/profiles/{key}` | Profile photos from people search |
| `POST /oauth/token` | Authenticates with the client assertion instead |
| `GET /.well-known/oauth-authorization-server` | OAuth discovery document |

Every other endpoint returns `401` without a valid credential.

## Revocation and expiry

* A revoked key stops working on its next request. While parts of Sixtyfour are degraded, it can keep working for up to five minutes.
* An expired key stops working at its expiry time. Sixtyfour emails your organization before longer-lived keys expire; see [Expiration](https://docs.sixtyfour.ai/get-api-key.md#expiration).
* Archiving a team revokes its keys.
* Disabling or deleting an OAuth client invalidates its tokens on their next request.

When Sixtyfour cannot check a key, the request fails without being charged: billable endpoints return `503` with `Retry-After: 5`, and the others return `500`. Retry the same request. See [503 Service Unavailable](https://docs.sixtyfour.ai/api-reference/errors.md#503-service-unavailable).

## Request IDs

Every response carries an `X-Correlation-ID` header:

```http theme={null}
X-Correlation-ID: enrich_3f8b2c1e-7a4d-4e9b-8c21-5d6f0a9b1e47
```

Log it with each request, and include it when you [contact support](https://docs.sixtyfour.ai/guides/getting-support.md). It is the **Request ID** column in [exported usage logs](https://docs.sixtyfour.ai/guides/usage-logs.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.