# Authentication

All Platform API requests require an API key. The API key identifies your organization and grants access to the partners, flows, and results within it.

## API Keys

API keys are managed from the **API Keys** page in the application. Each key belongs to your organization and has a name for your reference.

To create a key:

1. Open the **API Keys** page
2. Click **Add API Key**
3. Enter a name (for example "Production" or "Staging")
4. Click **Submit**

The key is displayed only at creation time. Copy it immediately and store it securely: it is never shown again, and the list that follows carries the key's name, scope, and creator, never the key itself. If you lose one, delete it and create another.

You can create multiple API keys for different environments or integrations.

## Key Scope

The list shows each key's scope, and the endpoint pages say which scope they need.

- **standard** -- reaches your whole organization. Every key you create on this page is a standard key.
- **sandbox** -- issued automatically when you set up a sandbox webhook sink, and scoped to that sandbox traffic. Organization-wide endpoints reject it with `403 forbidden`: the feed, the EDI transactions list, and resend.

## Making Requests

Include your API key in the `Authorization` header using the `Key` scheme:

```
Authorization: Key your-api-key-here
```

All API endpoints use the base path `/platform/` and return JSON responses.

Example request:

```bash
curl -X GET "https://tediware.com/platform/results" \
  -H "Authorization: Key your-api-key-here"
```

If the key is missing or invalid, the API returns a `401` response:

```json
{
  "error": {
    "message": "API key is missing",
    "code": "unauthorized"
  }
}
```

## Revoking a Key

To revoke an API key, navigate to **Settings** then **API Keys**, find the key, and click **Delete**. Any requests using that key will immediately begin returning `401` responses.