> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zenamu.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

Send an API key with the HTTP Bearer authentication scheme:

```http theme={null}
Authorization: Bearer <your_api_key>
```

Your studio gets **two keys**, and which one an endpoint accepts is part of its
contract. Sending the wrong key fails — the two are never interchangeable.

## Public API key

Prefix `zen_pub_`. It reads the data your studio already publishes: the
schedule, workshops, lecturers, and locations.

* Safe to ship in client-side code
* CORS is open, so you can call it from any origin
* Exposes no personal data

## Secret API key

Prefix `zen_live_`. It reads and writes client data.

* **Backend only.** Never call it from a browser or a mobile app
* Exposes personal data, including names, emails, and balances
* Can grant credits and entry passes, which changes what clients owe and hold

<Warning>
  Never put the secret key in front-end code, a mobile app bundle, or a public
  repository. Anyone holding it can read your entire client list.
</Warning>

## Getting your keys

In the Zenamu admin, open **Settings** → **General info** → **API keys**, then
select **Generate API keys**.

The secret key is displayed once, at generation time. Zenamu stores only a hash
of it, so it cannot be shown again — if you lose it, regenerate the pair.

<Note>
  Self-service generation requires the Ultimate plan. Studios on a trial get
  their keys from [Zenamu support](https://zenamu.com/contact/). See [Plans and access](/api#plans-and-access).
</Note>

## Rotating keys

Regenerating replaces both keys at once and the previous pair stops working
**immediately**. Every integration using the old keys breaks until you swap in
the new ones, so plan the rotation rather than doing it live.

## Authentication errors

| Status | Message                                                                                                                    | Cause                                                                                        |
| -----: | -------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
|  `400` | `Authorization header has to start with 'Bearer ' sequence. Example: ('Authorization: Bearer YOUR_ACCESS_TOKEN' )`         | The header is present but does not use the Bearer scheme.                                    |
|  `401` | `Missing access token. You must send your access token in the request header ('Authorization: Bearer YOUR_ACCESS_TOKEN' )` | No `Authorization` header was sent.                                                          |
|  `404` | `API key not found`                                                                                                        | The key is not recognized, or it is the wrong tier for this endpoint.                        |
|  `403` | `The Zenamu public API is not available on the Free tariff.`                                                               | A public key is valid, but the studio is on Free.                                            |
|  `403` | `The Zenamu API is only available on the Ultimate tariff.`                                                                 | A secret key is valid, but the studio is not on Ultimate or Trial.                           |
|  `403` | `This feature is not available in your current tariff plan`                                                                | A pass grant explicitly targets a non-default group that the studio's plan does not include. |

The `400` and `401` messages retain legacy wording. Your credential is still an
API key.

<Warning>
  An unknown key answers `404`, not `401`. This is unusual, and a client that
  only branches on `401` will misread a bad key as a missing resource. Treat
  `404` on a list endpoint as an authentication failure.
</Warning>

Authentication runs before parameter validation. A request that both omits its
key and passes a bad `dateFrom` returns the authentication error.

## CORS

The four public endpoints answer cross-origin requests from any origin, so a
browser can call them directly with the public key.

The private endpoints — `/v1/clients`, `/v1/pass-groups`, and the credit and
pass endpoints — are backend-only. All of them block CORS outright, so there is
no origin a browser can call them from. Do not plan on browser access to any of
them: the secret key must never reach a browser in the first place.