> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hooksnode.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Use a workspace API key.

The REST API uses workspace [API keys](/workspaces/api-keys). Send the key in one of these headers:

<CodeGroup>
  ```bash Bearer theme={null}
  curl https://hooksnode.com/api/v1/projects \
    -H "Authorization: Bearer $HOOKSNODE_API_KEY"
  ```

  ```bash X-API-Key theme={null}
  curl https://hooksnode.com/api/v1/projects \
    -H "X-API-Key: $HOOKSNODE_API_KEY"
  ```
</CodeGroup>

A key reaches only the projects of its workspace. A project in another workspace answers `404`.

## Errors

| Status | Body                             | Meaning                                                   |
| ------ | -------------------------------- | --------------------------------------------------------- |
| `401`  | `{"error":"API key required"}`   | No key was sent.                                          |
| `401`  | `{"error":"invalid API key"}`    | The key is wrong or revoked.                              |
| `403`  | `{"error":"email_not_verified"}` | The person who made the key has not verified their email. |
| `403`  | `{"error":"account suspended"}`  | The workspace is suspended.                               |

## Rate limit

Each key can make 600 requests a minute. Over the limit, the API answers `429`.

## The ingest URL

`POST /p/<source-id>` does not use API keys. Anyone with the URL can send events. To refuse unsigned events, turn on [inbound signing](/sources/webhook#check-signatures-on-the-way-in).