> ## Documentation Index
> Fetch the complete documentation index at: https://docs.frozi.lol/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate with the frozi.lol API using API keys

## Overview

Every request to the **public API** (leaderboard, lookup, etc.) must include a valid API key. Keys are managed in the dashboard and assigned **permissions** that control which endpoints you can call.

## Sending the API key

Send your API key in the request using **one** of these headers:

| Header                            | Example                          |
| --------------------------------- | -------------------------------- |
| `Authorization: Bearer <API_KEY>` | `Authorization: Bearer 3Zg5m...` |

<Warning>
  Keep your API key secret. Do not expose it in client-side code or public repositories.
</Warning>

## Permissions

Keys are assigned permissions when you request them. The API expects:

| Permission        | Use                                                                             |
| ----------------- | ------------------------------------------------------------------------------- |
| `api.leaderboard` | Leaderboard endpoint only — `GET /api/leaderboard`                              |
| `api.lookup`      | All lookup-related endpoints: profile by username/UID/authId, and profile links |

* A key with only `api.leaderboard` can call the leaderboard endpoint but will receive **403 Forbidden** on lookup endpoints.
* A key with only `api.lookup` can call all lookup endpoints but will receive **403** on the leaderboard.
* You can request both permissions when creating a key if your app needs both.