> ## Documentation Index
> Fetch the complete documentation index at: https://developer.dizplai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> The two headers every call to api.dizplai.com uses.

Every call sends **`x-api-key`**, which says which app is calling and sets its usage plan. It identifies the app; it never grants access on its own.

| Caller | `x-api-key` | `Authorization` |
| - | - | - |
| Your platform's servers | Your secret key. Never in a browser or an app | `Bearer <issuer token>`: a short-lived token Dizplai issues to your servers, for the same client |
| Your fan app, reading | Your app's publishable key, `pk_live_...`. Safe in an app | None |
| Your fan app, on a vote | The publishable key | `Bearer <fan's token>`, from your own login. See [Fan identity](/fan-identity.md) |

**When a token fails,** the API answers `401` with a `WWW-Authenticate` header. Get a fresh token and retry once. If it fails again, sign the user in again.

**Every response** carries `x-request-id`. Quote it when you report an issue.

**Limits.** Over your usage plan, the API answers `429` with `Retry-After`. Wait that long, then retry. See [Errors and retries](/errors.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.