> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rhizomeai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate with the Rhizome API

## API Keys

All API requests require an API key passed in the `x-api-key` header.

```bash theme={null}
curl -X POST https://api.rhizomeai.com/api/search \
  -H "Content-Type: application/json" \
  -H "x-api-key: YOUR_API_KEY" \
  -d '{"query_text": "example"}'
```

## Getting an API Key

1. Log in to [Rhizome](https://rhizomeai.com)
2. Go to [API Keys](https://rhizomeai.com/api-keys)
3. Click **Create API Key**
4. Copy your key immediately — it's only shown once!

<Warning>
  API access requires an enterprise plan. Contact
  [support@rhizomeai.com](mailto:support@rhizomeai.com) to upgrade your account.
</Warning>

## Security Best Practices

<AccordionGroup>
  <Accordion title="Never expose your API key in client-side code">
    API keys should only be used in server-side code. Never include them in JavaScript running in the browser.
  </Accordion>

  <Accordion title="Use environment variables">
    Store your API key in environment variables, not in source code.

    ```bash theme={null}
    export RHIZOME_API_KEY="your-api-key"
    ```

    ```python theme={null}
    import os
    api_key = os.environ["RHIZOME_API_KEY"]
    ```
  </Accordion>

  <Accordion title="Rotate keys if compromised">
    If you suspect your API key has been compromised, delete it immediately from the [API Keys console](https://rhizomeai.com/api-keys) and create a new one.
  </Accordion>
</AccordionGroup>

## Error Responses

| Status | Error                                 | Description                                         |
| ------ | ------------------------------------- | --------------------------------------------------- |
| 401    | `Missing or invalid x-api-key header` | No API key provided                                 |
| 401    | `Invalid API key`                     | The API key doesn't exist or was deleted            |
| 429    | `Rate limit exceeded`                 | Too many requests (see [Rate Limits](/rate-limits)) |