> ## Documentation Index
> Fetch the complete documentation index at: https://docs.beachdepository.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate with the Beach Depository API using API keys

All API requests require a valid API key sent as a Bearer token in the `Authorization` header.

## Creating an API key

API keys are created in the Beach Depository dashboard under **Settings > API Keys**. Each key is scoped to a single organization.

## Key format

Keys follow the format:

```
pv_live_<64-hex-chars>
```

## Permissions

Each API key has granular permissions that control which endpoints it can access. Available permission scopes are:

* `organizations:read`, `organizations:update`
* `members:read`
* `fbo_accounts:read`, `fbo_accounts:create`, `fbo_accounts:update`
* `inventory:read`
* `inbound_shipments:read`, `inbound_shipments:create`
* `outbound_requests:read`, `outbound_requests:create`, `outbound_requests:update`
* `outbound_shipments:read`
* `transfer_batches:read`, `transfer_batches:create`
* `return_shipments:read`
* `webhooks:manage`

A request to an endpoint without the required permission returns a `403 Forbidden` error. Holding-statement endpoints require `organizations:read`.

## Usage

Include the key in the `Authorization` header:

```bash theme={null}
curl https://api.beachdepository.com/v1/fbo-accounts \
  -H "Authorization: Bearer pv_live_abc123..."
```

## Revoking keys

Keys can be disabled temporarily or revoked permanently from the dashboard.

* **Disable** — pauses the key; you can re-enable it later.
* **Revoke** — permanently invalidates the key. Usage history is retained for audit.

Disabled and revoked keys return `401 Unauthorized` on API requests.