> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tenantcore.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> All API requests must include a Bearer token in the Authorization header.

## API key

Every request to the TenantCore API must include your API key in the `Authorization` header:

```bash theme={null}
Authorization: Bearer tc_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

Your key is available at [app.tenantcore.io/api](https://app.tenantcore.io/api). Reveal it, copy it, and store it in a secure location — treat it exactly like a password.

## Example request

```bash theme={null}
curl https://api.tenantcore.io/v1/tenants \
  -H "Authorization: Bearer tc_live_your_key_here" \
  -H "Accept: application/json"
```

## Key format

All TenantCore API keys follow this format:

```
tc_live_<48 hex characters>
```

Keys that do not match this format will be rejected with `401 Unauthorized`.

## Plan scoping

Your API key is tied to your active API plan. Two things are enforced on every authenticated request:

1. **Plan check** — if your API plan has lapsed or been cancelled, all requests return `402 Payment Required`
2. **Tenant ceiling** — write operations that would exceed your plan's tenant limit return `402 Payment Required`

| Plan        | Tenant ceiling |
| ----------- | -------------- |
| API Starter | 25 tenants     |
| API Growth  | 50 tenants     |
| API Scale   | 100 tenants    |

## Rotating your key

You can rotate your key at any time from the API page in the app. **The old key is invalidated immediately** — update all integrations before rotating.

You can also rotate via the API itself (authenticated with your current key):

```bash theme={null}
curl -X POST "https://api.tenantcore.io/api-key/rotate?user_email=you@example.com" \
  -H "Accept: application/json"
```

## Error responses

| Status | Code                   | Meaning                                   |
| ------ | ---------------------- | ----------------------------------------- |
| `401`  | `invalid_auth_header`  | Authorization header missing or malformed |
| `401`  | `missing_api_key`      | Bearer token is empty                     |
| `401`  | `invalid_api_key`      | Key not found or does not exist           |
| `402`  | `no_api_plan`          | No active API plan on this account        |
| `402`  | `tenant_limit_reached` | Write operation would exceed plan ceiling |