# Authentication

Every request needs an API key. Create and revoke keys in **[Dashboard → API keys](https://serpwiz.com/dashboard/keys)**.

## Sending the key

Use the `X-API-Key` header (recommended):

```bash
curl "https://api.serpwiz.com/v1/google/search?q=hello" -H "X-API-Key: sw_live_…"
```

These also work, in order of precedence after `X-API-Key`:

| Method | Example | Notes |
|---|---|---|
| Bearer token | `Authorization: Bearer sw_live_…` | Handy for HTTP clients and agent frameworks that only support bearer auth. |
| Query parameter | `?api_key=sw_live_…` | Convenient for quick tests and spreadsheets. Avoid it in production: URLs end up in logs and browser history. |

## Keys and limits

- Keys are shown **once**, when you create them. We store only a hash. If you lose a key, revoke it and create a new one.
- You can have up to 20 active keys — one per app or environment makes revoking painless.
- **All keys on an account share one rate limit and one balance.** More keys don't add throughput; a bigger plan does. See [Rate limits](/docs/rate-limits).
- You must verify your email address before keys work.

## Keep keys secret

API keys can spend your balance. Don't ship them in front-end JavaScript or mobile apps — call SerpWiz from your server, and pass results to the client. If a key leaks, revoke it in the dashboard; it stops working within a few minutes everywhere.

## Errors

| Status | `code` | Meaning |
|---|---|---|
| `401` | `unauthorized` | The key is missing, malformed, invalid or revoked. |
| `403` | `email_unverified` | Verify your email address first. |
| `403` | `account_suspended` | Contact [support@serpwiz.com](mailto:support@serpwiz.com). |