> ## Documentation Index
> Fetch the complete documentation index at: https://developers.getbukki.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate partner requests with workspace-scoped API keys.

Every public API request requires a Bukki API key in the `X-API-Key` header.

```bash theme={null}
curl "https://api.getbukki.com/v1/items" \
  -H "X-API-Key: $BUKKI_API_KEY"
```

## Workspace binding

An API key belongs to exactly one workspace. Bukki derives the workspace from the authenticated credential and rejects attempts to supply a different workspace through query or body parameters.

## Scope enforcement

Keys use least-privilege scopes:

| Scope           | Access                              |
| --------------- | ----------------------------------- |
| `contacts:read` | Read active customers and suppliers |
| `items:read`    | Read active products and services   |

A valid key without the required route scope receives `403 FORBIDDEN`.

## Secret handling

Bukki displays the full credential once and stores only a one-way hash. Treat the key like a password:

* Store it in a server-side secret manager
* Redact it from logs and error reports
* Use separate keys for separate integrations
* Revoke it immediately if it may have been exposed