> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/discordplace/discord.place/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Generate and use an API key to authenticate requests to the discord.place API.

Protected endpoints on the discord.place API use **API key authentication**. You pass the key in an `Authorization` request header — no bearer prefix, token scheme, or encoding required.

## Generating an API Key

<Steps>
  <Step title="Log in to discord.place">
    Go to [discord.place](https://discord.place) and sign in with your Discord account.
  </Step>

  <Step title="Open your bot's manage page">
    Navigate to your bot's listing and click the **Manage** button.
  </Step>

  <Step title="Go to the API Keys tab">
    Inside the manage page, select the **API Keys** tab from the navigation.
  </Step>

  <Step title="Generate a new key">
    Click **Generate API Key**. Copy the key immediately — it will not be shown again. You can rotate the key at any time from the same tab.
  </Step>
</Steps>

<Warning>
  Treat your API key like a password. Never expose it in client-side code, public repositories, or anywhere an untrusted party could read it. If a key is compromised, rotate it immediately from your bot's manage page.
</Warning>

## Using the API Key

Include the key as the value of the `Authorization` header on every authenticated request:

```bash theme={null}
curl -X PATCH https://api.discord.place/bots/123456789012345678/stats \
  -H "Authorization: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"server_count": 1500}'
```

In Node.js, load the key from an environment variable:

```javascript theme={null}
const response = await fetch('https://api.discord.place/bots/123456789012345678/stats', {
  method: 'PATCH',
  headers: {
    'Authorization': process.env.DISCORD_PLACE_API_KEY,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ server_count: client.guilds.cache.size })
});
```

## Error Responses

If the `Authorization` header is missing or the key is invalid, the API returns a `401` response.

<Tabs>
  <Tab title="Missing key">
    ```json theme={null}
    {
      "success": false,
      "error": "Authorization header is required.",
      "status": 401
    }
    ```
  </Tab>

  <Tab title="Invalid key">
    ```json theme={null}
    {
      "success": false,
      "error": "Invalid API key.",
      "status": 401
    }
    ```
  </Tab>
</Tabs>

## Security Best Practices

* Store API keys in environment variables or a secrets manager — never hard-code them.
* Restrict access to the key to only the services that need it.
* Rotate the key if there is any chance it was exposed.
* Do not log the raw value of the `Authorization` header in production.