> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usepatchwork.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys for the workbench. Session tokens or API keys for Loom.

Identify and the rest of the workbench authenticate with a **workspace API key**. Loom accepts that same key on the relay path, or a short-lived **session token** on the direct path.

```bash theme={null}
Authorization: Bearer YOUR_API_KEY
```

## API keys

Create and revoke keys on the Developers page. Each key is a name, a public id (`key_…`), and a secret (`sk_…`).

* The **secret** is a bearer token. Treat it like a password. Never put it in a browser or commit it.
* The **public id** goes in a direct session token's `iss` claim. It identifies the key; it authorizes nothing on its own.
* A revoked key stops working immediately.

There is no test/live split. Create two keys and name them if you want two piles of traffic. Leftover `sk_test_` secrets still authenticate and spend the same workspace balance.

We charge **outcomes**, not requests: an `identified` result on Identify, a closed run on Loom that isn't a platform failure. Promo credits cover first calls.

## Loom: two ingress modes

The credential's *form* selects the mode. A JWT bearer is **direct**. Anything else is a **relay** workspace API key. You do not declare a mode.

|              | Direct                           | Relay                         |
| ------------ | -------------------------------- | ----------------------------- |
| Bearer       | Session token your backend signs | Workspace API key (`sk_…`)    |
| Who calls us | The browser                      | Your backend                  |
| Subject      | Token `sub`                      | `Patchwork-Subject` header    |
| Connection   | Token `conn`, or header          | `Patchwork-Connection` header |

Same trust model on both paths: we hold your public key, we never mint identity, and every tool call to your backend is signed. Walk through [direct](/guides/loom-direct) or [relay](/guides/loom-relay).

## Unauthorized requests

Requests without a valid key or token return `401` and an [error envelope](/api-reference/errors). Send `Authorization` on every call.