> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tryblend.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate requests to the Blend AI Workflow API.

Every request to the API needs an API key. Generate one from your [API keys settings](https://tryblend.ai/settings?tab=api-keys).

## Bearer token

Send your API key in the `Authorization` header as a Bearer token:

```bash theme={null}
Authorization: Bearer bai_your_key_here
```

API keys always start with the `bai_` prefix. Any header missing the prefix or containing an invalid key returns a `401 authentication_error` with sub-code `invalid_api_key`.

<Warning>
  Treat API keys like passwords. Never commit them to source control or ship them in client-side code — use a server-side proxy if your frontend needs to call the API.
</Warning>

## Billing ownership

When an API key calls a workflow:

* The **key owner** is billed for the run (not the workflow author).
* The workflow author may earn a revenue share on public/published workflows.
* Runs are scoped to the key owner — you can only read back runs you started.

This means you can safely share published workflow IDs; callers spend their own credits to run them.

## Rate limits

Rate limits are enforced per API key. Every response includes these headers:

| Header                  | Meaning                                           |
| ----------------------- | ------------------------------------------------- |
| `X-RateLimit-Limit`     | Max requests in the current window.               |
| `X-RateLimit-Remaining` | Requests left in the current window.              |
| `X-RateLimit-Reset`     | Unix epoch (milliseconds) when the window resets. |
| `Retry-After`           | *Only on 429*. Seconds until retry is allowed.    |

If you exceed the limit, you'll get:

```http theme={null}
HTTP/1.1 429 Too Many Requests
Retry-After: 12
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1734567890000

{
    "error": {
        "message": "Rate limit exceeded. Try again later.",
        "type": "rate_limit_error",
        "code": "rate_limit_exceeded"
    }
}
```

Back off for at least `Retry-After` seconds before retrying.

## CORS

The API sets `Access-Control-Allow-Origin: *`, so browser calls from any origin work. However, exposing your API key in browser code is **never safe** — always proxy through your own server.

## What's next

<CardGroup cols={2}>
  <Card title="Errors" icon="triangle-exclamation" href="/api-reference/errors">
    Handle auth failures and other error conditions.
  </Card>

  <Card title="Start a run" icon="play" href="/endpoint/start-a-response">
    Make your first API call.
  </Card>
</CardGroup>