Authentication
# Authentication
Every request needs an API key. Use admin keys on your server and search keys everywhere else.
ZeroIndex uses bearer tokens. Send your key in the `Authorization` header of every request.
```bash
curl https://api.zeroindex.test/v1/indexes \
-H "Authorization: Bearer zi_admin_4f8a2c91e7"
```
## Header
<ParamField name="Authorization" type="string" required>
The word `Bearer`, a space and your API key.
</ParamField>
## Kinds of keys
There are two kinds of keys. You can create as many of each as you need.
- **Admin keys** start with `zi_admin_`. They can create and delete indexes, change settings and add documents.
- **Search keys** start with `zi_search_`. They can only search, so they are safe to use in a browser or a mobile app.
<Callout type="danger" title="Keep admin keys secret">
Anyone with an admin key can delete your indexes. If one leaks, revoke it in the dashboard straight away and create a new one.
</Callout>
## Scoped search keys
A scoped key limits a search key to some indexes or adds a filter to every query. Use one to make sure each customer only sees their own documents.
```js
const key = client.keys.createScoped({
parent: process.env.ZEROINDEX_SEARCH_KEY,
indexes: ["tickets"],
filter: "account_id = 4821",
expiresIn: "1h",
});
```
## Questions
<Accordion title="How many keys can I create?">
As many as you like. Most teams use one admin key per server and one search key per app.
</Accordion>
<Accordion title="Can I rotate a key without downtime?">
Yes. Create the new key, deploy it, then revoke the old one. Both work until you revoke.
</Accordion>
<Accordion title="Do keys expire?">
Admin and search keys never expire. Scoped keys expire after the time you set, up to 30 days.
</Accordion>
Every request needs an API key. Use admin keys on your server and search keys everywhere else.
ZeroIndex uses bearer tokens. Send your key in the Authorization header of every request.
curl https://api.zeroindex.test/v1/indexes \
-H "Authorization: Bearer zi_admin_4f8a2c91e7"Header
Authorizationstringrequired
The word Bearer, a space and your API key.
Kinds of keys
There are two kinds of keys. You can create as many of each as you need.
- Admin keys start with
zi_admin_. They can create and delete indexes, change settings and add documents. - Search keys start with
zi_search_. They can only search, so they are safe to use in a browser or a mobile app.
Scoped search keys
A scoped key limits a search key to some indexes or adds a filter to every query. Use one to make sure each customer only sees their own documents.
const key = client.keys.createScoped({
parent: process.env.ZEROINDEX_SEARCH_KEY,
indexes: ["tickets"],
filter: "account_id = 4821",
expiresIn: "1h",
});Questions
How many keys can I create?
As many as you like. Most teams use one admin key per server and one search key per app.
Can I rotate a key without downtime?
Yes. Create the new key, deploy it, then revoke the old one. Both work until you revoke.
Do keys expire?
Admin and search keys never expire. Scoped keys expire after the time you set, up to 30 days.