> ## Documentation Index
> Fetch the complete documentation index at: https://docs.makelocalads.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate LocalAds API requests with organization API keys.

LocalAds API keys belong to one organization. The key determines which
organization's brands and resources a request can access, so requests never
accept an organization ID. Brand-owned collection requests use `brand_id`.

## Send the key

Include the key in the `Authorization` header using the bearer scheme:

```http theme={null}
Authorization: Bearer lads_your_key
```

```bash theme={null}
curl https://makelocalads.com/api/v1/products \
  --header "Authorization: Bearer $LOCALADS_API_KEY"
```

## Keep keys safe

* Store keys in a secrets manager or server environment variable.
* Never put a key in browser code, mobile binaries, logs, or source control.
* Never send a key in a URL or query parameter.
* Revoke and replace a key immediately if it is exposed.

<Warning>
  The full secret is displayed only when the key is created. LocalAds stores a
  hash and cannot show the secret again.
</Warning>

## Permissions

Permissions are explicit. Product operations use these permissions:

| Operation                                  | Permission             |
| ------------------------------------------ | ---------------------- |
| List brands                                | `products:read`        |
| Create a product                           | `products:create`      |
| List or retrieve products                  | `products:read`        |
| Update a product                           | `products:update`      |
| Delete a product                           | `products:delete`      |
| Browse templates and generate a photoshoot | `photoshoots:generate` |

The `photoshoots:generate` permission includes reading the templates required
for generation and retrieving the resulting photoshoot.

A valid key without the required permission receives `403 Forbidden`. A
missing, disabled, expired, or invalid key receives `401 Unauthorized`.

## Rate limits

API keys have a broad per-key limit of 120 requests per minute. A rate-limited
request returns `429 Too Many Requests` with a `Retry-After` header.