# Authentication (https://terac.com/docs/developers/guides/authentication)

Authenticate with the Terac API using API keys and learn about rate limits.

## API Key [#api-key]

All requests require an API key passed via the `Authorization` header:

```
Authorization: Bearer YOUR_API_KEY
```

API keys are scoped per organization. You can generate and manage keys from your organization settings in the Terac dashboard.

## Rate Limits [#rate-limits]

Each API key can make 100 requests in a row. The count starts over only after more than 60 seconds pass with no accepted request on the key, so a key that never pauses for a full minute is refused after its 100th request, even at fewer than 100 requests a minute. Refused requests are not counted and do not extend the wait.

A refused request returns `429` with a `Retry-After` header: the number of seconds to wait, counted from the key's last accepted request.

```http
HTTP/1.1 429 Too Many Requests
Retry-After: 42
Content-Type: application/json

{
  "error": {
    "code": "RATE_LIMITED",
    "message": "Rate limit exceeded. Retry after 42 seconds."
  }
}
```

Wait for the number of seconds in `Retry-After`, then retry. A `429` does not mean the key is invalid, so do not rotate or revoke it. To keep steady traffic from being refused, pause for just over 60 seconds after every 100 requests on a key.