> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getreply.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, permissions and allowed IP addresses.

Send your key on every request as a Bearer token:

```
Authorization: Bearer gr_live_…
```

> [!WARNING]
>
> Requests sent here are real and charged like any other.

## Keys

Make keys in the app under **Developer → API keys** (Owner and Admin only). A key is shown once; we keep only a fingerprint of it, so nobody at GetReply can show it again. If you lose a key, switch it off and make a new one. Each new key sends a security email to the account owner.

## Permissions

| Permission | Can do |
| - | - |
| Full | Everything, including templates and webhooks |
| Send only | Send messages and campaigns, manage contacts, read everything |
| Read only | Read only |

Use Send only for your website or app; keep Full for admin tools.

## Allowed IP addresses

When you make a key you can list the addresses it may be used from, one per line. Requests from any other address answer `ip_not_allowed`. We use the address your request really came from; headers such as `X-Forwarded-For` that you send are ignored.

## When a key stops working

* **Switched off** in the app: it never comes back. Make a new one.
* **Off · plan ended**: the API needs Pro. The key comes back on by itself when you are on Pro again.
* Too many wrong keys from one address block that address for a while. See [Limits](https://docs.getreply.in/guides/limits.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.