> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tryhuntr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create, use, and recover Huntr API keys.

Huntr uses a single API key per account, passed on every authenticated request as the `x-api-key` header.

```bash theme={null}
curl https://api.tryhuntr.com/balance \
  -H "x-api-key: hntr_live_xxxxxxxxxxxx"
```

## Create an API key

### Dashboard (recommended)

1. Go to [tryhuntr.com/dashboard](https://tryhuntr.com/dashboard).
2. Sign up with your email.
3. Copy your API key from the dashboard.

You receive free starting credits — no credit card required.

### Email verification API

For programmatic signup flows:

**Step 1 — request verification**

```bash theme={null}
curl --request POST \
  --url https://api.tryhuntr.com/keys/create \
  --header 'content-type: application/json' \
  --data '{ "email": "you@company.com" }'
```

**Step 2 — click the link in your email**

The verification link calls `GET /verify?token=...` and returns your API key once. The token expires after 10 minutes.

Each email can have only one active key.

## Use your key

| Header         | Value                                |
| -------------- | ------------------------------------ |
| `x-api-key`    | Your Huntr API key (`hntr_live_...`) |
| `Content-Type` | `application/json` on POST requests  |

Authenticated endpoints return `401` when the key is missing or invalid.

## Recover a lost key

```bash theme={null}
curl --request POST \
  --url https://api.tryhuntr.com/keys/forgot \
  --header 'content-type: application/json' \
  --data '{ "email": "you@company.com" }'
```

Follow the reset link, then call `POST /keys/reset` with the token to receive a new key.

## Rotate or revoke

| Endpoint                | Purpose                                    |
| ----------------------- | ------------------------------------------ |
| `POST /keys/regenerate` | Issue a new key and invalidate the old one |
| `POST /keys/revoke`     | Permanently disable the current key        |

Both require the current valid `x-api-key`.

## Public endpoints

These work **without** authentication:

* `POST /keys/create` — start signup
* `GET /verify` — complete signup
* `GET /pricing` — public pricing matrix
* `GET /health` — health check

## Security practices

* Store keys in server-side secrets (env vars, vaults) — never in frontend code.
* Use separate keys per environment (staging vs production) when possible.
* Rotate immediately if a key is exposed.

## Next step

* [Quickstart](/quickstart) — make your first research call
* [Rate limits](/reference/rate-limits) — 5 requests/second per key
* [Credits and pricing](/concepts/credits-and-pricing) — how billing works