# Authentication

> API keys, the Authorization header, rotation, and the limits that apply per key and per account.

Source: https://sightradar.com/docs/authentication

All `/v1/*` endpoints require an API key sent as a Bearer token:

```http
Authorization: Bearer frs_<prefix>_<secret>
```

Only the [health probes](/docs/api/health) are unauthenticated.

## Creating a key

Create keys in the [console](/dashboard/keys) under **API Keys**. Give each key a name that says where it lives (`prod-indexer`, `staging`, `ci`). The plaintext is shown **once** at creation and is never recoverable; only an Argon2id hash is stored. If you lose a key, revoke it and mint a new one.

You can hold up to 50 active keys per account.

## Rotation

Keys are independent, so rotation is zero-downtime:

Create the new key and deploy it alongside the old one.

Watch 

**API Keys → Last used**

until the old key goes quiet.

Revoke the old key. Requests with it fail with 

`401`

immediately.

## Scope and isolation

A key acts for the whole account: every collection, batch, webhook and wallet call. Face vectors are namespaced per account and are never searchable across accounts. If you need separate blast radii for separate products, use separate accounts and invite your team to each.

## Limits

| Limit                                      | Behaviour                                                                       |
| ------------------------------------------ | ------------------------------------------------------------------------------- |
| Requests per second, per key               | Excess returns `429`. Back off and retry with jitter.                           |
| Concurrent in-flight requests, per account | Excess returns `429`.                                                           |
| Encoded image size                         | Images over 30 MB return `413`.                                                 |
| Wallet at zero                             | Billable calls return `402 Payment Required`; control-plane calls keep working. |

Batch indexing runs on its own queue and is the right tool once you have more than a few hundred photos to send at once. See [batch and webhooks](/docs/guides/batch-and-webhooks).

## Keep keys off the client

A key spends your credits, so it belongs on a server you control. Browser and mobile apps should call your backend, which calls SightRadar. The [console playground](/dashboard/playground) is the one browser surface that touches the API directly, and it does so through the console's own session, never with a raw key.

## Environment variables

Both official SDKs read `SIGHTRADAR_API_KEY` when no key is passed explicitly:

```bash
export SIGHTRADAR_API_KEY="frs_..."
```