> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dejavu.plus/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, Bearer tokens, and Device Flow

# Authentication

The v1 API accepts two API-key authentication methods:

* `x-api-key: <key>`
* `Authorization: Bearer <key>`

dejaVu keys generally use the `pk_` and `sk_` prefixes.

## Public key

A `pk_` key is intended for read operations.

```bash theme={null}
curl https://dejavu.plus/api/v1/me \
  -H "x-api-key: pk_YOUR_KEY"
```

## Secret key

An `sk_` key can be used for authorized read and write operations.

```bash theme={null}
curl https://dejavu.plus/api/v1/lists \
  -H "Authorization: Bearer sk_YOUR_KEY"
```

## Unsupported usage

Do not send a key in the query string:

```text theme={null}
/api/v1/me?api_key=...
```

This form is not supported by the v1 API.

## Device Flow

The Device Flow is intended for applications and devices that do not have a full browser.

The general flow is:

1. Request a device code.
2. Present the user code or QR code to the user.
3. Have the device approved in dejaVu.
4. Exchange the `device_code` for an access token.
5. Use the returned token as a Bearer token.

The approval operation requires an authenticated dejaVu session. See the **Auth** endpoints for the exact request and response formats.

## Security

* Never log API keys.
* Never place a secret key in JavaScript executed in the browser.
* Use HTTPS for every request.
* If a key is compromised, revoke it and create a new one.