> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blobrouter.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, dashboard JWTs, and how to authenticate every request.

<Info>
  **BlobRouter v0.1** · Last updated: August 2026 · Architecture version: **2.0**
</Info>

## Two auth modes

| Mode          | Header                                           | Used for                                           |
| ------------- | ------------------------------------------------ | -------------------------------------------------- |
| API key       | `Authorization: Bearer br_live_…` or `br_test_…` | SDK router: upload, get, delete, `/v1/me`          |
| Dashboard JWT | `Authorization: Bearer <supabase_access_token>`  | Scanner, providers, analytics, billing, key rotate |

```bash theme={null}
curl https://api.blobrouter.com/v1/me \
  -H "Authorization: Bearer $BLOBROUTER_API_KEY"
```

## API keys

* Format: `br_live_{uuid}` or `br_test_{uuid}`
* Create / view in the dashboard (Providers → API key)
* Rotate with `POST /v1/keys/rotate` — old key invalid immediately

Never embed keys in browsers, mobile apps, or public repos.

## Dashboard JWT

Obtained from Supabase Auth after login. The dashboard attaches it automatically. For scripting, use a short-lived access token from your session.

## Failures

| Status | Code           | Meaning                    |
| ------ | -------------- | -------------------------- |
| 401    | `unauthorized` | Missing/invalid key or JWT |

See [Errors](/api/errors).