# Authentication

> Authenticate with the Tarout API

# Authentication

The Tarout API supports two authentication methods: API keys and session tokens.

## API Keys

API keys provide long-lived access to the API. Use them for server-to-server integrations and CI/CD pipelines.

### Creating an API Key

1. Go to **Settings → API Keys** in the dashboard.
2. Click **Create API Key**.
3. Give the key a descriptive name.
4. Copy the key - it's only shown once.

### Using an API Key

Include the API key in the `Authorization` header:

```bash
curl https://tarout.sa/api/v1/applications \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"
```

### API Key Scopes

API keys have the same permissions as the user who created them. Keys created by an organization owner have full access.

## Session Tokens

Session tokens are used by the dashboard and CLI. They are short-lived and automatically refreshed.

### CLI Authentication

```bash
# Login (opens browser for OAuth flow)
tarout login

# Check status
tarout whoami
```

The CLI stores the session token securely and refreshes it automatically.

## Security Best Practices

- **Rotate keys regularly** - Delete and recreate API keys periodically.
- **Use environment variables** - Never hardcode API keys in source code.
- **Limit scope** - Create separate keys for different integrations.
- **Monitor usage** - Review API key activity in the dashboard.
- **Revoke compromised keys** - If a key is exposed, delete it immediately in Settings.

---

## Every Tarout agent guide

- [Start Here (Agents)](https://tarout.sa/docs/for-ai/start.md)
- [Overview](https://tarout.sa/docs/for-ai.md)
- [Deploying an app](https://tarout.sa/docs/for-ai/deploy.md)
- [Databases](https://tarout.sa/docs/for-ai/database.md)
- [Object storage](https://tarout.sa/docs/for-ai/storage.md)
- [Custom domains](https://tarout.sa/docs/for-ai/domains.md)
- [Plans and upgrades](https://tarout.sa/docs/for-ai/billing.md)
- [Troubleshooting](https://tarout.sa/docs/for-ai/troubleshoot.md)
- [Agent Onboarding](https://tarout.sa/docs/for-ai/onboarding.md)
- [CLI Reference](https://tarout.sa/docs/for-ai/cli-reference.md)
- [CLI JSON Schema](https://tarout.sa/docs/for-ai/cli-json-schema.md)

Whole corpus in one file: https://tarout.sa/llms-full.txt · index: https://tarout.sa/llms.txt
Any docs page is raw markdown at the same URL + `.md`. Short link to the entry point: https://tarout.sa/deploy.md