# Authentication

> How the StrideHQ API checks who's making each request.

The StrideHQ API needs every request to be authenticated with an API key. If a request isn't authenticated, the API returns a `401` authentication error.

## API key

To authenticate a request, send your API key in this HTTP header:

```http
Authorization: Bearer shq_test_...
```

Each key belongs to one organisation and works in one environment: keys starting `shq_test_` work in the sandbox, and keys starting `shq_live_` in production. A key's access is set by its scopes. A request the key's scopes don't cover gets a `403`. To learn about each scope, continue to [Scopes](https://developers.stridehq.ai/api-documentation/authentication/scopes.md).

To create and manage your keys, go to [API keys](https://developers.stridehq.ai/api-documentation/authentication/api-keys.md) and [Rotating and revoking keys](https://developers.stridehq.ai/api-documentation/authentication/rotating-and-revoking-keys.md).

## AI assistants

An API key belongs to your organisation, not a person, so don't put one into an AI assistant. To connect Claude, ChatGPT or another AI assistant, use the [MCP server](https://developers.stridehq.ai/mcp-server.md) instead. Each person signs in with their own StrideHQ login and gets their own permissions.