> ## Documentation Index
> Fetch the complete documentation index at: https://docs.liveohana.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate requests with an API key.

Every request needs an API key. A key belongs to one host profile and can read that profile's bookings.

## Create a key

1. In your Ohana dashboard, open **Developer** > **API Keys**.
2. Click **Create key** and give it a name you'll recognize later, such as "PMS sync".
3. Copy the key. It starts with `ohk_` and is shown only once.

> [!WARNING]
>
> Ohana stores only a hash of your key, so we can't show it to you again. If you lose it, regenerate it.

A host profile can have up to five active keys at a time. Disabled keys don't count toward the limit.

## Send the key

Pass the key as a bearer token in the `Authorization` header:

```bash theme={null}
curl https://liveohana.ai/api/v1/bookings \
  -H "Authorization: Bearer ohk_your_key_here"
```

Keep keys on your server. Don't put them in browser code, mobile apps, or source control.

## Manage keys

From **Developer** > **API Keys** you can:

* **Disable** a key to stop it working right away. You can enable it again later.
* **Regenerate** a key to replace its secret. The old secret stops working immediately, so update your integration with the new one.

Ohana staff can also disable a key if it appears to be compromised.

## Failed authentication

A missing, unknown, or disabled key returns `401` with the `invalid_api_key` error code. So does any key on a host profile whose API access has been turned off.

```json theme={null}
{
  "error": {
    "code": "invalid_api_key",
    "message": "This API key is invalid, disabled, or API access is turned off for your host profile."
  }
}
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.