# Authentication

The Tallymark API uses API keys to authenticate requests. Each key
belongs to one account and works on that account's data. Create and
revoke keys in Tallymark under
[Settings → Developers](https://app.tallymark.com/settings/developers).
The full key is only shown once, so copy it right away.

Send the key as a bearer token in the `Authorization` header of every
request.

```bash title="Authenticated request"
curl https://api.tallymark.com/account \
  -H "Authorization: Bearer $TALLYMARK_API_KEY"
```

When you create a key, choose its access:

- **Read only** keys can make GET requests, to list and show records.
- **Read & write** keys can also make POST requests, to create, update,
  send, pay, and delete.

Your API keys can read and change your billing data, so keep them
secret. Don't put them in client-side code, mobile apps, or source
control. Store them in your server's secrets manager or in an
environment variable. If a key leaks, revoke it and create a new one. A
revoked key stops working right away.