# API Keys

To [use our API](/docs/api), you need to [generate an API key](/keys/api).

Once you have your key, you can use it to authenticate your requests to our API.

With [`curl`](https://curl.se), you can use your API key to send messages and stream responses:

```bash
$ export AISH_API_KEY="sk_..."

$ curl -N -X POST 'https://api.aish.li/v1/responses' \
  -H "X-API-Key: $AISH_API_KEY" \
  -H 'Content-Type: application/json' \
  -H 'Accept: text/event-stream' \
  -d '{
    "model": "demo/gemini",
    "stream": true,
    "input": [
      {
        "type": "message",
        "role": "user",
        "content": "Hello!"
      }
    ]
  }'
```

or to list your agents:

```bash
$ curl -X 'GET' 'https://api.aish.li/v1/ai/agents?limit=3' \
  -H "X-API-Key: $AISH_API_KEY" \
  | jq .
```

A similar command is also shown after you click _Try it out_ and _Execute_ on the [API Reference](/docs/api).

Note that this `X-API-Key` header is different from the `Authorization: Bearer ...` header, which is used for OAuth2 token authentication on the interactive API docs only. The `X-API-Key` header is used instead of OAuth2 for API key authentication from your own backend systems.

> [!CAUTION]
> Your API Keys are sensitive and grant full access to your account without needing your login password—including your agents, session history, and settings.
>
> - Never share your API key publicly or commit it to Git repositories.
> - Never embed API keys in client-side HTML or JavaScript.
> - If you believe a key has been compromised, revoke it immediately using the trash icon on the [API Keys](/keys/api) page.

API Keys are only shown once when you create them. You will need to generate a new one if you lose it.