> ## Documentation Index
> Fetch the complete documentation index at: https://docs.privue.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate, what a call costs, and what happens when credits run out.

Every request takes your API key as a bearer token:

```bash theme={null}
curl https://api.privue.ai/usage/v1/summary \
  -H "Authorization: Bearer $PRIVUE_API_KEY"
```

Keys are shown once at issue. Store the key in a secret manager, never in client-side code or a
repository. If a key is exposed, ask us to revoke it and we will issue a replacement.

## Credits

A verification deducts one credit, after the call succeeds. A failed call is not charged, whether it
failed validation, was rejected by the source, or the source was unreachable.

These calls are never charged:

* `GET /digilocker-simple/v1/sessions/{session_id}/status`
* `GET /usage/v1/summary`
* `GET /usage/v1/calls`

Your remaining balance is returned as `credits_remaining` on every usage summary.

## When authentication fails

| Status | Meaning                                                                                             |
| ------ | --------------------------------------------------------------------------------------------------- |
| `401`  | The `Authorization` header is missing or malformed, or the key was rejected.                        |
| `403`  | The key is valid but is not permitted to call this endpoint, or is not linked to an active account. |
| `429`  | The key is out of credits, or is exceeding its rate limit.                                          |

A `403` is a provisioning problem rather than something to retry. Contact us and we will correct the
key's entitlements.

## Using several keys

You can hold more than one key, for example one per environment or per team. Usage from all of them
rolls up to the same account, and [usage](/suite/usage) reports totals across every key you hold.