> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vern.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, headers, and basic security guidance.

All Vern API requests authenticate with an API key passed in the `x-api-key` header.

```bash theme={null}
curl https://app.vern.so/api/v1/migrations \
  -H "x-api-key: YOUR_API_KEY"
```

A key is scoped to your **account** and can address every migration in it. The
key's creator becomes the owner of any migration it provisions.

## Get a key

Sign in to [app.vern.so](https://app.vern.so) and go to [Settings → API keys](https://app.vern.so/api-keys). Click **New key** and copy it — Vern doesn't show it again after creation.

For details on generating, rotating, and revoking keys, see [API keys](/help-center/settings/api-keys).

## What can go wrong

* **401 Unauthorized** — key is missing, malformed, or revoked. Creating a
  migration additionally requires API-key auth specifically (a session token is
  rejected).
* **429 Too many requests** — you've hit the rate limit. Back off and retry. See
  [Errors & limits](/migration-api/errors#rate-limits).

## Security

* Never put your key in client-side code. Vern's API is designed to be called from your backend.
* Use environment variables, not hardcoded strings.
* Rotate keys periodically and immediately if you suspect leakage.

## Next

* [Quickstart](/migration-api/quickstart) — make your first API call.
* [Errors & limits](/migration-api/errors) — the shared error and rate-limit model.