> For the complete documentation index, see [llms.txt](https://bountyv.gitbook.io/vdocs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://bountyv.gitbook.io/vdocs/authentication.md).

# Authentication

Every request to the Substance AI API must include an API key in the `Authorization` header.

## Header format

```
Authorization: Bearer sk_live_abc123...
```

## How to get a key

You need one Substance account. Create it either way:

* **Email + password** — sign up on the website.
* **Login with V-Auth** — if you already have a V-Auth identity, use it; no separate password.

That single account is everything: sign in to the billing portal on the website to collect your API key and top up, and sign in to the Substance desktop app with the same credentials. There is no separate API login.

Your key is shown in the portal. Treat it like a password — it carries your full balance and entitlements.

Spending is denominated in **V-Tokens** whichever way you signed up; see [Credits & pricing](/vdocs/account/credits.md).

## Security best practices

* **Never commit keys to source control.** Use environment variables (`.env`, secret managers, etc.)
* **Never expose keys in client-side code.** All API calls should originate from your backend.
* **Rotate compromised keys immediately.** If you suspect a leak, contact us — we'll revoke the key and issue a new one.
* **Use separate keys per environment.** Request different keys for dev, staging, and production so you can revoke any one without affecting the others.

## Testing your key

The fastest way to confirm a key is valid:

```bash
curl https://substance-api.com/api/v1/credits \
  -H "Authorization: Bearer sk_live_..."
```

* `200 OK` with a balance — key is valid
* `401 Unauthorized` — key is missing, malformed, or revoked

## Key revocation

Keys can be revoked at any time. A revoked key returns `401` on every subsequent request. Any in-flight requests at the moment of revocation will complete normally, but new requests will fail.

## Rate limits

There are no hard rate limits currently. All requests are billed against your balance, so heavy usage consumes credits quickly. We monitor for abuse and may throttle keys showing unusual traffic patterns.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://bountyv.gitbook.io/vdocs/authentication.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.