> ## Documentation Index
> Fetch the complete documentation index at: https://docs.osint.ly/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate every API request with your bearer token.

All API endpoints require a bearer token in the `Authorization` header.

<Note>
  Radar is included in the Free plan, but it still requires authentication. Create an Osintly account, generate a free API key, then call `GET /radar/breaches` and `GET /radar/breaches/{name}` with that key.
</Note>

<Note>
  If your key belongs to a plan without Radar enabled, these endpoints return `403` with `PLAN_FEATURE_REQUIRED`.
</Note>

## Header format

```bash theme={null}
Authorization: Bearer YOUR_API_KEY
```

<Note>
  Use the root auth endpoint `GET /` to quickly validate a token.
</Note>

## Validate token

```bash theme={null}
curl -X GET "https://api.osint.ly" \
  -H "Authorization: Bearer YOUR_API_KEY"
```

Expected success response:

```json theme={null}
{
  "message": "Authorization Valid",
  "help": "https://docs.osint.ly/api-reference/quick-start"
}
```

## Example Radar request (free API key)

```bash theme={null}
curl -X GET "https://api.osint.ly/radar/breaches?limit=3&sortBy=recently-added" \
  -H "Authorization: Bearer YOUR_API_KEY"
```

## Security Best Practices

* Never commit API keys to git repositories
* Store tokens in environment variables
* Use separate keys for development and production
* Rotate keys immediately after suspected exposure

<Warning>
  If a token is exposed, revoke and replace it before any new deployment.
</Warning>

## Terms and ethics

* Terms of Use: [https://osint.ly/terms](https://osint.ly/terms)
* Ethics Policy: [https://osint.ly/ethics](https://osint.ly/ethics)

## Next Steps

Continue with [Quick Start](/api-reference/quick-start) to create and stream your first search.