> ## Documentation Index
> Fetch the complete documentation index at: https://docs.shim.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to generate and use API keys

# Authentication

All Shim API requests require an API key passed in the `Authorization` header.

***

## Getting Your API Key

<Steps>
  <Step title="Sign up">
    Create a free account at [console.shim.so/signup](https://console.shim.so/signup)
  </Step>

  <Step title="Navigate to Console">
    Go to [console.shim.so](https://console.shim.so)
  </Step>

  <Step title="Generate Key">
    Click "API Keys" -> "Create Your First Key"
  </Step>

  <Step title="Copy and Store">
    Copy the key immediately. We do not store the full key.
  </Step>
</Steps>

***

## Using Your API Key

Include your API key in the `Authorization` header as a Bearer token:

```bash theme={null}
Authorization: Bearer sk_live_xxxxx
```

### Example Request

```typescript theme={null}
const response = await fetch('https://api.shim.so/v1/repair', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer sk_live_xxxxx',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ raw_output: '{"broken": "json"' })
});
```

***

## Key Format

* **Production keys:** `sk_live_xxxxx`
* **Test keys:** `sk_test_xxxxx` (coming soon)

<Warning>
  Never commit API keys to version control. Use environment variables:

  ```bash theme={null}
  export SHIM_API_KEY=sk_live_xxxxx
  ```
</Warning>

***

## Rate Limits by Tier

| Tier | Requests/Minute | Monthly Limit |
| ---- | --------------- | ------------- |
| Free | 100             | 1,000         |
| Pro  | 1,000           | 100,000       |
| Team | 10,000          | 1,000,000     |

See [Rate Limits](/guides/rate-limits) for overage behavior.

***

## Security Best Practices

<AccordionGroup>
  <Accordion title="Rotate keys regularly">
    Generate a new key every 90 days. Delete old keys immediately.
  </Accordion>

  <Accordion title="Use environment variables">
    Never hardcode keys in source code. Use `.env` files (gitignored).
  </Accordion>

  <Accordion title="Restrict key scope">
    Create separate keys for development, staging, and production.
  </Accordion>

  <Accordion title="Monitor usage">
    Check your console for unexpected spikes in usage.
  </Accordion>
</AccordionGroup>

***

## Troubleshooting

All responses return HTTP 200. Errors are in the response body under `metadata.errors`.

### INVALID\_API\_KEY / MISSING\_API\_KEY

**Cause:** Invalid, missing, or revoked API key
**Fix:** Check that your key is correct and included in the `Authorization` header. Check `success: false` and `metadata.errors[0].code` in the response body.

### RATE\_LIMIT\_EXCEEDED

**Cause:** Per-minute rate limit exceeded
**Fix:** Implement exponential backoff or upgrade your tier. Check `X-RateLimit-Reset` header for when the window resets.

See [Troubleshooting](/troubleshooting) for more common issues.