> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useboom.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate with an organization API key.

All requests are made to the base URL `https://www.useboom.ai` and require an
organization API key, sent as a Bearer token:

```http theme={null}
Authorization: Bearer boom_org_xxxxxxxxxxxxxxxxxxxx
```

* The key identifies your organization. **You never pass an organization
  id**: it's derived from the key, and every request is scoped to it.
* Keys are prefixed `boom_org_` and are shown **once** at creation. Store
  the key securely; Boom only retains a hash.
* Revoking a key in the dashboard immediately rejects further requests
  with `401`.

<Warning>
  Treat API keys like passwords. Never embed them in client-side code,
  mobile apps, or public repositories. Use server-to-server calls only.
</Warning>

## Environments

Boom exposes two environments. Each has its own organizations and its own API
keys. A production key is not valid against the development host, and vice
versa.

| Environment     | Base URL                 | Use                               |
| --------------- | ------------------------ | --------------------------------- |
| **Production**  | `https://www.useboom.ai` | Live data and real journeys       |
| **Development** | `https://dev.useboom.ai` | A sandbox for integration testing |

In the interactive API reference, switch the target with the **server
dropdown** at the top of each endpoint. In your own code, set the base URL once
(e.g. `export BASE="https://dev.useboom.ai/api/v1/cdp"`) so you can point the
same integration at either environment.

## Errors

A `401` is returned with one of two messages depending on the failure mode:

| Status | `error` message                             | When                                                 |
| ------ | ------------------------------------------- | ---------------------------------------------------- |
| `401`  | `Missing or malformed Authorization header` | The header is absent or not in `Bearer <key>` format |
| `401`  | `Invalid or revoked API key`                | The key failed verification (wrong key, or revoked)  |

```json theme={null}
{ "error": "Invalid or revoked API key" }
```

## Related

<CardGroup cols={2}>
  <Card title="Quickstart" icon="rocket" href="/quickstart">
    Make your first authenticated calls end to end.
  </Card>

  <Card title="Rate limits & errors" icon="gauge-high" href="/rate-limits-and-errors">
    Per-key limits, headers, and the shared error shape.
  </Card>

  <Card title="One uniform surface" icon="layers" href="/one-surface">
    The same capabilities over REST and MCP.
  </Card>
</CardGroup>