> ## Documentation Index
> Fetch the complete documentation index at: https://docs.3ringscapital.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How API keys work, and the difference between live and sandbox.

The 3Rings API authenticates with a **secret API key**, passed as a bearer token on every request:

```bash theme={null}
curl https://api.3ringscapital.co/v1/businesses \
  --header 'Authorization: Bearer 3r_live_•••'
```

## Key types

| Prefix | Environment | Base URL |
| - | - | - |
| `3r_test_` | Sandbox — safe, isolated test data | `https://api-sandbox.3ringscapital.co` |
| `3r_live_` | Production — real books | `https://api.3ringscapital.co` |

Keys are issued per partner from the dashboard. A partner can hold several keys (for example, one
per environment or per deployment) and rotate them independently.

> [!WARNING]
>
> A secret key can read and write every business under your partner account. Keep it on your
> server, store it in a secret manager, and never expose it in browsers, mobile apps or public
> repositories. If a key leaks, rotate it from the dashboard immediately.

## Errors

A missing, malformed or revoked key returns `401 Unauthorized`:

```json theme={null}
{
  "error": {
    "type": "unauthorized",
    "message": "Missing or invalid API key.",
    "code": "auth.invalid_key"
  }
}
```

See [Errors](https://docs.3ringscapital.co/guides/errors.md) for the full error model.

## Roadmap: OAuth2 for partners

Secret keys are the first authentication method. A full **OAuth2 client-credentials** flow — with
scoped tokens per integration — is on the roadmap for partners who need finer-grained access.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.