> ## Documentation Index
> Fetch the complete documentation index at: https://docs.landedfees.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Bearer API keys, format, rotation, revocation, and per-tier limits.

## Bearer keys

Every request must send an `Authorization: Bearer <key>` header. The
key format is `sk_live_` followed by 32 hex characters (40 characters
total). Sandbox keys use the `sk_test_` prefix; production keys use
`sk_live_`.

```http theme={null}
GET /api/v1/rates/US/8517.62.00 HTTP/1.1
Host: www.landedfees.com
Authorization: Bearer sk_live_a1b2c3d4e5f60718293a4b5c6d7e8f90
```

Keys are hashed with scrypt and stored salted. The raw value is shown
exactly once, when the key is created. LandedFees cannot recover a
lost key.

## Where to mint keys

1. Sign in and open **Settings > API keys**.
2. Click **Create key**, give it a memorable name (e.g. `prod-erp`,
   `ci-nightly-audit`), and copy the raw value.
3. Store the key in your secret manager (AWS Secrets Manager, Vault,
   Doppler, GitHub Actions secrets, etc.). Never commit it.

## Key rotation

Rotate keys on the same cadence as your other production secrets. A
90-day cycle is a reasonable default.

1. Mint a new key.
2. Deploy the new key to your systems.
3. Watch **Settings > API keys > last used** on the old key until it
   stops firing.
4. Revoke the old key.

Rotation is zero-downtime: multiple active keys can coexist under one
organization.

## Revocation

Revoked keys return `401 API_KEY_REVOKED` immediately on the next
request. Revocation is instant and irreversible. Revoke a key when:

* It leaks into a repo, log, or client-side bundle.
* An engineer who owned the key leaves the team.
* A dependent system is decommissioned.

## Per-tier quotas and gating

API access requires a Growth-or-higher subscription. Free and Pro
tiers cannot mint keys, and any existing key on a downgraded
organization returns `402 TIER_DOWNGRADED` on the next call. Upgrading
restores access without needing to rotate.

| Tier       | Monthly calls | Seats     | API access |
| ---------- | ------------- | --------- | ---------- |
| Free       | 0             | 1         | No         |
| Pro        | 0             | 1         | No         |
| Growth     | 50,000        | 5         | Yes        |
| Business   | 500,000       | 15        | Yes        |
| Enterprise | Custom        | Unlimited | Yes        |

Monthly quotas roll over at 00:00 UTC on the first of the month. When
you exceed the quota, subsequent calls return `402 QUOTA_EXCEEDED`
until the reset or an upgrade.

## Sandbox mode

Mint an `sk_test_...` key from **Settings > API keys > Test keys**.
Sandbox calls do not count against your monthly quota. Rate tables in
sandbox match production exactly (there is no fake data), so responses
are trustworthy for integration testing.

## Security posture

* TLS 1.2 or higher only. Requests to `http://` are refused.
* Rate limit: 60 requests per minute per key. See [Rate limits](/rate-limits).
* Every response carries an `X-Request-Id` header. Include it in
  support requests so we can pull the call log.
* Keys never appear in server logs, error envelopes, or webhook
  payloads.