> ## Documentation Index
> Fetch the complete documentation index at: https://docs.athenahq.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate API requests using API keys

## API Key Authentication

All API requests must include an API key in the request headers. API keys are passed using the `x-api-key` header.

```bash theme={null}
curl https://api.athenahq.ai/api/v1/websites \
  -H "x-api-key: your_api_key_here"
```

## Creating API Keys

API keys can be created and managed through your organization's dashboard.

<Card title="Manage API Keys" icon="key" href="https://app.athenahq.ai/organization?tab=api">
  Create, view, and manage API keys in your organization settings
</Card>

## API Key Scoping

API keys belong to an organization and can be scoped to specific websites within that organization. This allows for granular access control when managing multiple websites under a single organization.

* Each API key is associated with an organization
* Organizations can contain multiple websites
* API keys can be scoped to one or more specific websites
* Scoped API keys only have access to data from their assigned websites

### Global vs. scoped keys

A **global** key covers the whole organization; a **scoped** key is limited to its assigned websites. Some organization-wide endpoints require a global key and reject a scoped one with `403 Forbidden: global API key required`:

* **Role management** — all `/api/v1/roles` endpoints
* **Organization members** — `/api/v1/organizations/members/{user_id}` (update/remove)
* **Groups** — `/api/v1/groups` management and group members
* **Organization and group invites** — `POST /api/v1/invites` with `type: "organization"` or `type: "group"` (website invites also work with a scoped key that includes the target website)

Global keys are admin-equivalent — only an organization admin or owner can create one — so these endpoints enforce the same admin-level access as the dashboard.

<Warning>
  Only organization admins can create, edit, or delete API keys. Ensure you have the appropriate permissions before attempting to manage API keys.
</Warning>