---
title: "Authentication"
description: "Authenticate with the TurboPentest API using a Bearer token in the Authorization header on every request. Covers key format, required headers, and error responses."
canonical: https://turbopentest.com/docs/api/authentication
source: "TurboPentest Docs"
---

# Authentication

All API requests are authenticated with a Bearer token passed in the `Authorization` header. This is the one and only authentication scheme - there is no `X-API-Key` header.

## Creating an API key

1. Go to **Dashboard > API Keys**
2. Click **Create Key**
3. Copy the key immediately - it is only shown once

Keys have a `tp_` prefix. The key is stored only as a SHA-256 hash - TurboPentest never keeps the raw value, so a lost key cannot be recovered and must be replaced.

## Using your key

Include the key as a Bearer token in every request:

```bash
curl -H "Authorization: Bearer tp_your_key_here" \
  https://turbopentest.com/api/pentests
```

## Error responses

| Status | Meaning |
|--------|---------|
| `401` | Missing or invalid Bearer token |
| `402` | No credits available |
| `403` | Domain not verified or insufficient permissions |
| `400` | Invalid request body |
| `404` | Resource not found |

All errors return JSON:
```json
{
  "error": "Description of the error"
}
```

## Rate limits

The API is rate-limited to protect service quality. If you receive a `429` response, wait before retrying. Contact support if you need higher limits.