> ## Documentation Index
> Fetch the complete documentation index at: https://docs.watchdoc.sphinxhq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate every API request with a workspace API key.

All requests require a bearer token:

```
Authorization: Bearer <api_key>
```

Keys are created in the app under **Settings → API key**. Each key is scoped to one workspace
(`Org`). Calls authenticated with a key always run against that workspace, never against
whichever org the key creator last clicked into in the UI. Unlike OAuth client secrets, the
API key stays visible in Settings so you can copy it again later — regenerate it if it leaks.

## Permissions

A key inherits the permissions of the workspace role it was created under:

| Permission         | Gates                                                          |
| ------------------ | -------------------------------------------------------------- |
| `view_documents`   | Reading checks, sending feedback, reading rules and thresholds |
| `upload_documents` | Submitting documents                                           |
| `manage_documents` | Creating, editing, and deleting rules; changing thresholds     |

Both built-in roles can read and submit. `manage_documents` is on the Admin role only.

The flag catalogue (`GET /api/v1/document-checks/flags/`) is a static reference table and needs
no document permission, only a valid key.