> ## Documentation Index
> Fetch the complete documentation index at: https://docs.theculpernetwork.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate to the Culper API with a campaign-scoped bearer key.

The Culper API uses **campaign-scoped bearer tokens** (similar to the Supabase CLI or a GitHub
personal access token). One key = one campaign, read-only.

## Getting a key

<Note>
  Manage keys yourself in the campaign dashboard under **Settings → API** — create, view, and
  revoke campaign-scoped keys there. The API is in **private beta**: if you don't see the tab, it
  isn't enabled for your campaign yet — contact the Culper team to turn it on.
</Note>

A key looks like this and is shown **once** at creation — store it somewhere safe (the example
below is a placeholder, not a real key):

```
culper_sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

We store only a hash of your key, never the key itself. If it leaks, we revoke it and issue a new
one — the old key stops working immediately.

## Using your key

Send it as a bearer token on every request:

<CodeGroup>
  ```bash Authorization header theme={null}
  curl https://theculpernetwork.com/api/v1/walks \
    -H "Authorization: Bearer culper_sk_live_…"
  ```

  ```bash x-api-key header theme={null}
  curl https://theculpernetwork.com/api/v1/walks \
    -H "x-api-key: culper_sk_live_…"
  ```
</CodeGroup>

## Scopes

Each key carries a set of read scopes. Requesting an endpoint your key doesn't have a scope for
returns `403 forbidden`.

| Scope          | Grants                                       |
| -------------- | -------------------------------------------- |
| `walks:read`   | The Walks endpoints (live).                  |
| `lists:read`   | The Lists endpoints (coming soon).           |
| `outdoor:read` | The Outdoor / signs endpoints (coming soon). |
| `sms:read`     | The SMS reporting endpoints (coming soon).   |

<Warning>
  Keep your key secret. It grants read access to your whole campaign's data for its scopes. Never
  embed it in a mobile app, browser, or public repo — call the API from a server you control.
</Warning>