> ## Documentation Index
> Fetch the complete documentation index at: https://docs.omnichar.org/llms.txt
> Use this file to discover all available pages before exploring further.

# API authentication and environments

> Authenticate with a team API key in the Authorization header. sk_test_ keys use the sandbox environment and sk_live_ keys use production.

Every call that changes or reads your team's data sends a team key as a Bearer token:

```bash theme={null}
curl -s https://api.omnichar.org/v1/team -H "Authorization: Bearer $OMNICHAR_API_KEY"
```

## Two environments, chosen by the key

Each team has two environments that never share data:

| Key prefix | Environment | What it does |
| - | - | - |
| `sk_test_` | sandbox | Characters are mocked and ready in about 30 seconds. No GPU runs and no builds or credits are spent. Licenses start with `lic_test_`. |
| `sk_live_` | production | Characters are built for real and each build uses one build from your balance, or credits once builds run out. Licenses start with `lic_live_`. |

The environment comes from the key alone. No request parameter can switch it, and a sandbox key never sees production data, or the other way round.

## Creating keys

Owners, admins and developers create keys in **Settings → API keys** with the team selected, choosing Production or Sandbox when they create one. A key is shown once. Store it as a secret and never put it in browser or mobile code.

Each key has scopes. A new key gets every scope except the `webhooks` and `runs` ones, which you tick when a key needs them:

| Scope | Lets the key |
| - | - |
| `chars:read` | read characters and their build status |
| `chars:write` | upload references, create and retrain characters |
| `licenses:read` | list licenses your team issued or holds |
| `licenses:write` | issue and revoke licenses (provider teams only) |
| `usage:read` | read your team's balance and the [usage of licensed characters](https://docs.omnichar.org/api/usage.md) |
| `webhooks:read` | list your team's webhook endpoints and their delivery logs |
| `webhooks:write` | add, change, test and delete webhook endpoints |
| `runs:read` | read your team's runs and their outputs |
| `runs:write` | generate images and video, and upload inputs for them |

A key without the scope a call needs gets `403`.

## Rotating and revoking

**Rotate** gives you a new key with the same name and scopes. The old key keeps working for 24 hours so you can swap it without downtime, then stops. **Revoke** stops a key on its next request.

A key also stops working if the person who created it leaves the team or can no longer manage keys. Rotate it from an account that can.

## Check which key you are using

`GET /v1/team` needs no scope and answers with your team and environment:

```json theme={null}
{ "id": "2c0d...", "name": "OWND", "plan": "partner", "env": "sandbox" }
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.