# API keys

API keys authenticate requests to the QACrow API. Create them from **API & Webhooks → API keys**.

- Each key has a **name** and a list of **scopes** (e.g. `runs:write`, `plans:read`).
- The full secret is shown **once** at creation — copy it immediately.
- Keys are workspace-scoped and can be revoked at any time.

Pass the key in the `Authorization` header:

```
Authorization: Bearer qac_live_...
```

See [API → Authentication](/content/docs/api/authentication/index.html).