> For the complete documentation index, see [llms.txt](https://docs.layerlens.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.layerlens.ai/more-in-this-section-9/auth.md).

# Authentication

API authentication — API keys, scopes, headers.

```http
GET /api/v1/models
X-API-Key: ll_xxxxxx
```

## Scopes

`traces:read`, `traces:write`, `replay:execute`, `feedback:write`, `feedback:read`, `admin`, `ingest`.

## Errors

* `401` missing or invalid key
* `403` valid key but missing scope

## Browser security: keys are server-side only

API keys must never appear in browser code. Stratix does **not** emit CORS headers, so browser-direct calls are blocked by preflight regardless. Always proxy through your own backend — see the [calling Stratix from a backend](/more-in-this-section-4/calling-stratix-from-a-backend.md) guide.

## See also

* [API keys](/more-in-this-section-9/api-keys.md)
* [SDK auth](/more-in-this-section-9/authentication.md)