> ## Documentation Index
> Fetch the complete documentation index at: https://getfaceage.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate API requests with your secret key, and identify your business with the Face Age ID.

Face Age uses two different credentials. Use the right one for each job:

| Credential | Where to find it | Used for |
| - | - | - |
| **Secret key** (authorization key) | Panel → profile menu → **Authorization Key** | Calling the management API (businesses, templates, quizzes) as a `Bearer` token |
| **Face Age ID** (API key) | Panel → your business → **API keys** | Identifying a business in the SDKs and the skin analyze widget |

> [!WARNING]
>
> The secret key gives full access to your account. Never expose it in browser or mobile app code. The Face Age ID is meant for client-side use — restrict it to your own domains with [Add access](https://getfaceage.com/docs/api-reference/business/add-access.md).

## Secret key

The secret key authenticates API requests. It is issued through the OAuth2 authorization process, is unique to your account and is valid for **1 year**.

Send it as a Bearer token in the `Authorization` header of every request:

```bash theme={null}
curl https://core.getfaceage.com/api/v1/business \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer your_secret_key'
```

## Generate a secret key

**1. Open Authorization Key**

Log in to [panel.getfaceage.com](https://panel.getfaceage.com), open the profile menu and select **Authorization Key**.

**2. Generate the key**

Click **Generate Authorization Key** — or **Change Authorization Key** if you already have one.

![Authorization Key page in the Face Age panel](https://mintcdn.com/getfaceage-com/wLP35CGqBY74yiOL/images/developer-guides/authorization-key.png?fit=max\&auto=format\&n=wLP35CGqBY74yiOL\&q=85\&s=09b1eaa5f52b39956d0c86ba3e6a09a5)

**3. Store it securely**

The key is displayed only once. Store it in a safe place, such as a secrets manager or environment variable.

If your key is lost or compromised, generate a new one. You can regenerate it as many times as you need.

## Errors

Requests without a valid secret key return `401 Unauthorized`:

```json theme={null}
{
  "message": "Unauthenticated."
}
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.