---
title: Authentication
description: "How to authenticate with the Caged API."
---

# Authentication

The Caged API uses **API keys** for authentication. All authenticated requests must include a Bearer token in the `Authorization` header.

## Getting an API Key

1. Sign up at [caged.dev/signup](https://caged.dev/signup)
2. Go to **Dashboard → Settings → API Keys**
3. Click **Create API Key**
4. Copy the key — it's only shown once

API keys start with `caged_sk_` and look like:

```
caged_sk_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6
```

## Using Your API Key

Include it as a Bearer token:

```bash
curl -H "Authorization: Bearer caged_sk_..." \
  https://api.caged.dev/v1/sandboxes
```

## Signup

<ParamField body="email" type="string" required>
  Account email address.
</ParamField>
<ParamField body="password" type="string" required>
  Account password (min 8 characters).
</ParamField>
<ParamField body="name" type="string">
  Display name.
</ParamField>

```bash
curl -X POST https://api.caged.dev/signup \
  -H "Content-Type: application/json" \
  -d '{"email": "dev@example.com", "password": "securepass", "name": "Dev"}'
```

## Login

Returns a session token for dashboard access.

```bash
curl -X POST https://api.caged.dev/login \
  -H "Content-Type: application/json" \
  -d '{"email": "dev@example.com", "password": "securepass"}'
```

## Key Scopes

| Scope | Access |
|-------|--------|
| `full` | All API operations |
| `sandbox` | Create, manage, destroy sandboxes only |
| `read` | Read-only access to sandboxes and sessions |

## Security Best Practices

<Warning>
Never commit API keys to source control. Use environment variables or a secrets manager.
</Warning>

- Rotate keys regularly
- Use the narrowest scope possible
- Set key expiration dates
- Monitor key usage in the dashboard