# Authentication

AUTHENTICATION

All requests are authenticated with a bearer token. Never expose a secret key in
client-side code.


SENDING THE KEY

const res = await fetch("https://api.acme.dev/v1/messages", {
  headers: { Authorization: `Bearer ${process.env.ACME_KEY}` }
});


SCOPES

 * read - list and fetch resources
 * write - create and update
 * admin - manage keys

A request beyond your key's scope returns 403 Forbidden.