> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ondial.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Bearer API keys (ond_live / ond_test) — name, request, approve, use.

Public `/api/v1` requests use an account API key as a Bearer token (or `X-API-Key`).

<Warning>
  Treat the API key as a server-side secret. Do not put it in browsers, mobile apps, public repos, or logs.
</Warning>

## Get your API key

1. Log in to the [Ondial dashboard](https://dashboard.ondial.ai).
2. Open **API Access**.
3. Submit a request with:
   * **Key name** — friendly label (e.g. `Production CRM`) shown in your list and to Super Admin
   * **Mode** — `sandbox` or `live`
   * **Why** — short use-case note for approval
4. **Super Admin** approves (or denies). On approve, the operator receives the plaintext key **once**.
5. Optionally **Rename** the key later in API Access (does not change the secret).

Tenants **cannot** self-issue live keys.

| Prefix       | Behavior                                                        |
| ------------ | --------------------------------------------------------------- |
| `ond_test_…` | Sandbox — accept leads; no PSTN / live WA/email; no credit burn |
| `ond_live_…` | Live path after DNC + consent                                   |

## Try It

1. Open [Ping](/api-reference/endpoint/core/ping).
2. Paste the key into **BearerAuth** (playground adds `Bearer`).
3. Choose Production or Local (`localhost:3001`).
4. **Send**.

## cURL

```bash theme={"system"}
export ONDIAL_BASE_URL="https://dashboard.ondial.ai"
export ONDIAL_API_KEY="ond_test_xxxxxxxx"

curl -sS -H "Authorization: Bearer $ONDIAL_API_KEY" \
  "$ONDIAL_BASE_URL/api/v1/ping"
```

Alternative header: `X-API-Key: $ONDIAL_API_KEY`.

## Revoke / rotate / kill switch

* Tenant **Rotate** / **Delete** from API Access (or Super Admin rotate/revoke) → old secret stops working
* Super Admin **revoke** / **suspend** → `401 unauthorized`
* Global kill switch → `503 api_globally_disabled` on all `/api/v1/*`