> ## Documentation Index
> Fetch the complete documentation index at: https://retinaos.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# RetinaOS API Authentication: Keys, Headers, and Errors

> How to generate a RetinaOS API key, pass it in the Authorization Bearer header on every request, rotate keys safely, and handle authentication errors.

The RetinaOS API uses API keys for authentication. Every authenticated request must include your key in the `Authorization` header. Keys are generated from your account dashboard and grant access according to your subscription plan.

## Generate an API Key

<Steps>
  <Step title="Sign in">
    Sign in at [app.retinaos.xyz](https://app.retinaos.xyz).
  </Step>

  <Step title="Open API Keys settings">
    Go to **Settings → API Keys**.
  </Step>

  <Step title="Create a new key">
    Click **Generate New Key**.
  </Step>

  <Step title="Name your key">
    Give the key a descriptive name (e.g., `My trading bot`).
  </Step>

  <Step title="Copy the key">
    Copy the key immediately — it is shown only once.
  </Step>
</Steps>

<Warning>
  Store your API key securely. Do not commit it to source code or expose it in client-side JavaScript. If compromised, revoke it immediately from **Settings → API Keys**.
</Warning>

## Pass the Key in Requests

Include your key in the `Authorization` header of every request:

```bash theme={null}
curl -X GET https://api.retinaos.xyz/v1/tokens \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Accept: application/json"
```

<CodeGroup>
  ```python Python theme={null}
  import requests

  headers = {
      "Authorization": "Bearer YOUR_API_KEY",
      "Accept": "application/json"
  }

  response = requests.get("https://api.retinaos.xyz/v1/tokens", headers=headers)
  data = response.json()
  ```

  ```typescript TypeScript theme={null}
  const response = await fetch('https://api.retinaos.xyz/v1/tokens', {
    headers: {
      'Authorization': 'Bearer YOUR_API_KEY',
      'Accept': 'application/json',
    },
  });
  const data = await response.json();
  ```
</CodeGroup>

## Authentication Errors

| Error          | HTTP Status | Cause                               |
| -------------- | ----------- | ----------------------------------- |
| `UNAUTHORIZED` | 401         | Key missing, malformed, or revoked  |
| `FORBIDDEN`    | 403         | Feature requires a higher plan tier |

## Revoking a Key

Go to **Settings → API Keys → (key name) → Revoke**. The key becomes invalid immediately. Generate a new key to restore access.