# Authentication

API keys belong to the workspace. Each has a name and controls every output, or only the outputs you choose.

## Make a key

1. In Airframe, open **Organisation settings** and find **API keys**. Owners and admins manage keys, and they come with the Solo and Studio plans.
2. Choose **New key**, name it after what will use it, for example `Companion in the gallery`.
3. Choose what it controls: **All outputs**, including ones made later, or **Chosen outputs**.
4. Copy the key. It's shown once. If you lose it, revoke it and make another.

Keys look like `afk_…`. Older output tokens, which look like `afo_…`, still work the same way.

## Send it

Send the key as a bearer token on every request:

```http
Authorization: Bearer afk_…
```

Browsers can't set headers on a WebSocket, so the [control WebSocket](https://docs.airframe.tv/api/websocket) also takes it as `?token=`.

> **Treat keys like passwords.** Anyone with a key can run the outputs it controls. Keep keys out of front-end code and version control, and revoke a key straight away if it leaks.

## What a key can do

A key runs the show on the outputs it controls, the same as an operator in the control room:

- Read an output's state and the composition it plays.
- Run [commands](https://docs.airframe.tv/api/commands), over HTTP or the [control WebSocket](https://docs.airframe.tv/api/websocket).
- List, create, change and remove [instances](https://docs.airframe.tv/api/list-instances).

It can't change what the show is. Editing and publishing compositions, and choosing which version an output plays, happen in Airframe.

## Change or revoke a key

Choose **Edit** on a key to rename it or change the outputs it controls; changes apply on its next request. **Revoke** stops it working at once. Each key shows when it was last used, so you can spot ones nothing uses any more.