# Authentication

> Create a Gensiv workspace API key and send it with every API request.

Every request needs a workspace API key.

## Create a key

1. In Gensiv, open **Settings > API keys**. Keys are available on Starter and up, and only owners and admins can create them.
2. Choose **Create key**, give it a name and pick when it expires: 30 days, 90 days, 1 year or never.
3. Turn on **Allow changes** only if the key needs to write. Leave it off for scripts that only read.
4. Copy the key. It starts with `gsk_` and is shown once, so store it in a password manager or secret store.

## Send the key

Send the key in the `x-api-key` header:

```bash
curl https://app.gensiv.com/api/v1/brands \
  -H "x-api-key: $GENSIV_API_KEY"
```

`Authorization: Bearer gsk_...` works too.

## What a key can see

A key belongs to its workspace, not to the person who created it, so it keeps working if they leave. Every key sees every brand in the workspace.

## Read and write keys

| Key                            | Can do                                                                                          |
| ------------------------------ | ----------------------------------------------------------------------------------------------- |
| Read only (default)            | Every `GET` endpoint                                                                            |
| Read and write (Allow changes) | Every `GET` endpoint, plus the `POST`, `PATCH`, `PUT` and `DELETE` endpoints marked **write** |

A read-only key that calls a write endpoint gets `403`. The access is fixed when the key is created: to change it, create a new key and revoke the old one. **Settings > API keys** shows each key as Read only or Read and write.

Writes follow the same rules as the app: plan limits apply, deletes can't be undone, and starting an article or page refresh spends writing credits. Changes made with a key show no author in Gensiv.

Revoke a key in **Settings > API keys** and the next request with it fails with `401`.

The same key also connects agents to the [MCP server](/docs/mcp/setup).

---

Source: https://gensiv.com/docs/api/authentication