# Authentication

# Authentication

Every endpoint requires an API key. Send it as a bearer token:

```bash
curl https://api.becomingyou.com/v1/values-bridge/assessment \
  -H "Authorization: Bearer $BYL_API_KEY"
```

Requests without a key, or with a revoked one, are rejected at the gateway with
`401 Unauthorized` and never reach the API.

Your key identifies your partner account, and every session and result you
create is scoped to it. A key can only read data it created, so a request for
another partner's session returns `404 not_found` rather than `403`.

Contact Becoming You Labs to be issued a key. Treat it as a server-side secret:
never ship it in a browser, mobile app, or any other client your users control.

## Rate limits

Requests are limited to **120 per minute** per API key. Exceeding the limit
returns `429 Too Many Requests`; retry after a short backoff.