> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dbhost.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate with the DBHost API.

## API keys

All API requests require a Bearer token in the `Authorization` header:

```bash theme={null}
curl -H "Authorization: Bearer dbh_your_api_key_here" \
  https://dbhost.app/api/v1/databases
```

Pro and Business use the same Bearer-token flow for the REST API and CLI. The API also enforces request shaping protections such as body-size limits and route-aware rate limiting for abusive traffic.

## Creating an API key

1. Sign in to [dbhost.app](https://dbhost.app)
2. Go to **Settings**
3. Click **Create Key**
4. Choose either `Selected databases` or `Full account access`
5. Copy the key (shown once for that secret)

<Note>API key creation requires a Pro or Business plan.</Note>

`Selected databases` is the recommended default and limits the key to only the databases you choose. `Full account access` can create and manage every database in your account.

If you later need a fresh secret for the same key, use **Replace key** in Settings. The old secret stops working immediately, and the replacement secret is shown once.

Selected-database keys cannot create databases. Creating a database requires a full-account key.

## Scope behavior

* `GET /api/v1/databases` returns only the databases visible to the authenticated key
* Database-specific routes outside the key's scope return `DATABASE_NOT_FOUND`
* Full-account-only routes, such as database creation, return `KEY_SCOPE_DENIED`

## Using the CLI

Install the [CLI](/cli), then save your key:

```bash theme={null}
dbhost auth login --api-key dbh_your_api_key_here
```

## Error responses

| Status | Code                 | Description                                                                    |
| ------ | -------------------- | ------------------------------------------------------------------------------ |
| 401    | `UNAUTHORIZED`       | Missing or invalid API key                                                     |
| 403    | `KEY_SCOPE_DENIED`   | Key is valid but lacks the required full-account scope                         |
| 404    | `DATABASE_NOT_FOUND` | Database doesn't exist, isn't owned by this user, or isn't visible to this key |
| 413    | `PAYLOAD_TOO_LARGE`  | Request body is larger than the supported API limit                            |
| 429    | `RATE_LIMITED`       | Too many requests for the current route or too many unauthorized attempts      |

If you receive `429 RATE_LIMITED`, back off and retry after the number of seconds in the `Retry-After` header.