# Authentication

URL: https://docs.healthcare.dev/authentication

Send your key in the `Authorization` header on every `/v1` request:

```http
Authorization: Bearer hdev_live_ab12cd34_...
```

The MCP server also accepts `x-api-key: hdev_live_...`.

## Live and test keys

| Prefix       | Data      | Limits                          | Billed |
| ------------ | --------- | ------------------------------- | ------ |
| `hdev_live_` | All       | Your plan's limits              | Yes    |
| `hdev_test_` | Same data | 2 requests/s, 1,000 calls/month | Never  |

## Public endpoints

`/v1/status`, `/healthz` and `/openapi.json` need no key.

## Handling keys

- Keys are shown once. We store only a salted hash and a short public prefix (`hdev_live_ab12cd34`)
  so you can tell keys apart in the dashboard.
- Keep keys on your server. Never ship a live key in browser or mobile code.
- Revoke a leaked key in the dashboard; revocation takes effect within 30 seconds.

## Errors

A missing, malformed or revoked key returns `401` with `type`
`https://healthcare.dev/problems/unauthorized`. See [Errors](/errors).