> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reverselooker.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> All requests to the Reverse Looker API require a valid API key

## Getting an API key

<Steps>
  <Step title="Create an account">
    Sign up at [app.reverselooker.com](https://app.reverselooker.com)
  </Step>

  <Step title="Purchase a paid plan">
    Any paid plan (subscription or pay-as-you-go) enable Reverse Looker API.
    Go to [app.reverselooker.com/billing](https://app.reverselooker.com/billing)
  </Step>

  <Step title="Access settings">
    Go to **Settings** → **API Keys**
  </Step>

  <Step title="Generate a key">
    Click **Create API Key** and give it a descriptive name
  </Step>
</Steps>

## Usage

Include your API key in the `x-api-key` header of each request:

```bash theme={null}
curl -X POST https://api.reverselooker.com/reverse-contact/single \
  -H "Content-Type: application/json" \
  -H "x-api-key: rl_live_abc123..." \
  -d '{"email": "john@company.com"}'
```

<CodeGroup>
  ```javascript Node.js theme={null}
  const response = await fetch('https://api.reverselooker.com/reverse-contact/single', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'x-api-key': process.env.REVERSELOOKER_API_KEY
    },
    body: JSON.stringify({ email: 'john@company.com' })
  });
  ```

  ```python Python theme={null}
  import requests
  import os

  response = requests.post(
      'https://api.reverselooker.com/reverse-contact/single',
      headers={
          'Content-Type': 'application/json',
          'x-api-key': os.environ['REVERSELOOKER_API_KEY']
      },
      json={'email': 'john@company.com'}
  )
  ```

  ```go Go theme={null}
  req, _ := http.NewRequest("POST", "https://api.reverselooker.com/reverse-contact/single", body)
  req.Header.Set("Content-Type", "application/json")
  req.Header.Set("x-api-key", os.Getenv("REVERSELOOKER_API_KEY"))
  ```

  ```php PHP theme={null}
  $ch = curl_init('https://api.reverselooker.com/reverse-contact/single');
  curl_setopt($ch, CURLOPT_HTTPHEADER, [
      'Content-Type: application/json',
      'x-api-key: ' . getenv('REVERSELOOKER_API_KEY')
  ]);
  ```
</CodeGroup>

## Key types

| Type | Prefix     | Usage                                  |
| ---- | ---------- | -------------------------------------- |
| Live | `rl_live_` | Production                             |
| Test | `rl_test_` | Development (does not consume credits) |

<Warning>
  Test keys return mock data and should not be used in production.
</Warning>

## Best practices

<CardGroup cols={2}>
  <Card title="Environment variables" icon="lock">
    Never hardcode your API key in the code. Use environment variables.
  </Card>

  <Card title="One key per environment" icon="layer-group">
    Create separate keys for development, staging, and production.
  </Card>

  <Card title="Regular rotation" icon="rotate">
    Rotate your keys periodically and after any security incident.
  </Card>

  <Card title="Minimal permissions" icon="shield">
    Use keys with only the necessary permissions.
  </Card>
</CardGroup>

## Authentication errors

| Code | Message            | Cause                         |
| ---- | ------------------ | ----------------------------- |
| 401  | `Missing API key`  | `x-api-key` header is missing |
| 401  | `Invalid API key`  | API key is invalid or revoked |
| 403  | `API key disabled` | Key disabled by administrator |

```json Example 401 response theme={null}
{
  "error": "Invalid API key",
  "message": "The provided API key is not valid or has been revoked"
}
```

## Revoking a key

If you suspect a key has been compromised:

1. Log in to [app.reverselooker.com](https://app.reverselooker.com)
2. Go to **Settings** → **API Keys**
3. Click **Revoke** next to the affected key
4. Generate a new key
5. Update your applications

<Note>
  Revocation is immediate. All requests using this key will fail instantly.
</Note>