> ## Documentation Index
> Fetch the complete documentation index at: https://docs.offthehook.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate with Off the Hook

> All Off the Hook API requests use Bearer token authentication. Pass your oth_… API key in the Authorization header on every request.

Every request to the Off the Hook API must include your API key in the `Authorization` header. The API uses standard Bearer token authentication — there are no sessions, cookies, or OAuth flows to manage.

## Header format

Include your API key on every request to a `/v1/*` endpoint:

```
Authorization: Bearer oth_YOUR_API_KEY
```

API keys are always prefixed with `oth_`. Here is a complete `curl` example:

```bash theme={null}
curl https://api.offthehook.dev/v1/subscriptions \
  -H "Authorization: Bearer oth_YOUR_API_KEY"
```

<Tip>
  Store your API key in an environment variable and reference it in your code and scripts rather than hardcoding it. For example: `export OTH_API_KEY=oth_...` and then `-H "Authorization: Bearer $OTH_API_KEY"`. Never commit an API key to source control.
</Tip>

## Error responses

If the `Authorization` header is missing, malformed, or contains an invalid key, the API returns a `401 Unauthorized` response:

```json theme={null}
{
  "error": "unauthorized",
  "message": "invalid API key",
  "requestId": "..."
}
```

The `error` field is a stable string code you can branch on in your error handling logic. The `message` field is a human-readable description intended for debugging.

<Note>
  Every error response includes a `requestId` field. The same value is also present in the `X-Request-Id` response header on every API response, including successful ones. If you contact support about an unexpected error, include the `requestId` so the team can locate the request in the logs.
</Note>