> ## Documentation Index
> Fetch the complete documentation index at: https://docs.yousonder.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Every request uses an API key the author creates in Sonder.

Send the key as a bearer token on every request:

```bash theme={null}
Authorization: Bearer sonder_live_q8Zr2mN4xT7vB1cK9pL3sD6fG0hJ5wYe
```

## Where keys come from

Authors create keys in Sonder under **Settings → [API keys](https://app.yousonder.com/settings?tab=api)**, or your app gets one through [one-click connect](/guides/one-click-connect). Both kinds work the same way.

* **Read-only.** A key can read the author's videos, views, books, name and email. It can't change anything or post.
* **One author.** A key only ever sees the account that created it.
* **Shown once.** Sonder stores only a one-way hash, so a lost key can't be recovered. The author revokes it and creates another.
* **No expiry.** A key works until the author revokes it. Revoking takes effect within a minute.
* **Needs an active plan.** If the author's Sonder plan lapses, calls return `403 plan_inactive` until the plan is active again. The key itself stays valid.

Authors can hold up to 10 keys at once.

## Keep keys secret

Treat a key like a password: store it encrypted, never put it in a URL or client-side code, and never log it. If one leaks, ask the author to revoke it in Settings.

## Errors

| Status | `error.code`      | What it means                                                                    |
| ------ | ----------------- | -------------------------------------------------------------------------------- |
| 401    | `missing_api_key` | No `Authorization: Bearer` header.                                               |
| 401    | `invalid_api_key` | The key is malformed or doesn't exist. Check it was copied in full.              |
| 401    | `api_key_revoked` | The author revoked it. Ask them to reconnect.                                    |
| 403    | `plan_inactive`   | The author's Sonder plan isn't active. Retry later; don't delete the connection. |