# Authentication

> Authenticate every request with your API key in the Authorization header. No Bearer prefix. How to keep the key safe and what each authentication error means.

Source: https://www.fluentc.ai/docs/authentication/

## How it works

Every endpoint requires your API key in the `Authorization` header. Send the key exactly as the dashboard shows it.

```http
Authorization: YOUR_FLUENTC_KEY
```

```bash
curl https://api.fluentc.ai/ai_agent/languages \
  -H "Authorization: $FLUENTC_KEY"
```

> **Warning:** Do not add a `Bearer` prefix. `Authorization: Bearer YOUR_FLUENTC_KEY` is read as a different, unknown key and fails with `401` and `"Invalid API key: Site not found."` Many HTTP clients and agent frameworks add `Bearer` automatically when you set a token, so set the header by hand.

You get a key when you [sign up](https://dashboard.fluentc.io/users/sign_up). The same key works for the REST API, the MCP server, the LangChain tools, the n8n node, and Make or Zapier.

## What a key controls

A key belongs to one FluentC site in your account, and the site decides what the key can do:

- **Languages.** Only languages enabled for the key can be used as `target_language` or `source_language`. List them with [Languages](https://www.fluentc.ai/docs/api/languages.md).
- **Mode.** A Batch plan key can use `batch` mode. A Real-time plan key can use both `real-time` and `batch`. See [Concepts](https://www.fluentc.ai/docs/concepts.md#plans-and-modes).
- **Status.** If the subscription is inactive, translation is disabled for the site, or a usage limit is reached, requests fail with `403`.

## Keeping the key safe

- Call FluentC from a server, a workflow runner or an agent runtime. Never ship the key in a browser, a mobile app or a public repository.
- Store it in an environment variable or a secret manager. The examples use `FLUENTC_KEY`.
- Use a separate key per environment when you can, so a leak in one place doesn't affect the others.
- If you think a key has been exposed, [contact us](https://www.fluentc.ai/contact/) right away.

## Authentication errors

| Status | Message | Cause |
| --- | --- | --- |
| `401` | `API key (Site UUID) is missing` | The `Authorization` header is absent or empty. |
| `401` | `Invalid API key: Site not found.` | The key is wrong, has extra characters, or has a `Bearer` prefix. |
| `401` | `Invalid API key: Associated company not found.` | The key's account can't be resolved. [Contact us](https://www.fluentc.ai/contact/). |
| `403` | `Access denied: Translations are disabled for this site.` | Translation is switched off for the key's site. |
| `403` | `Subscription error: ...` | The subscription isn't active. The message says why. |
| `403` | `Usage limit error: ...` | A usage limit was reached. The message says which. |

The API calls the key a "Site UUID" in some messages. It is the same thing as the API key in the dashboard.

Don't retry a `401` or `403` without changing something. Fix the key or the account first. All error shapes are on the [Errors](https://www.fluentc.ai/docs/api/errors.md) page.