> For the complete documentation index, see [llms.txt](https://docs.bitmind.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bitmind.ai/api-reference/authentication.md).

# Authentication

BitMind APIs use the same HTTP Bearer authentication format.

```http
Authorization: Bearer <YOUR_API_KEY>
```

## What changes between APIs

The header format is identical.

The accepted key type is different.

### API

`https://api.bitmind.ai`

Accepts standard API keys for normal platform usage.

These are typically universal service keys.

### Enterprise API

`https://enterprise.bitmind.ai`

Requires an enterprise API key.

These keys are enterprise-tier credentials.

Standard API keys are rejected with `401 Unauthorized`.

## API key authentication

Use API keys for server-to-server requests.

### Standard API example

```http
Authorization: Bearer your-api-key
```

### Enterprise API example

```http
Authorization: Bearer enterprise-your-key
```

## JWT authentication

Use JWTs for user-facing applications where supported.

```http
Authorization: Bearer your-jwt-token
```

## Headers

Some applications also send an application identifier header.

```http
x-bitmind-application: oracle-api
```

## Rate limits

* **API key users**: Based on subscription tier
* **JWT users**: `1` request/second with burst up to `5`

## Best practices

* Store tokens in environment variables or a secret manager.
* Never commit tokens to source control.
* Rotate long-lived credentials regularly.
* Use enterprise keys only against enterprise endpoints.