# Authentication

Authenticate server-side requests with a scoped organisation API key.

## Authorization header

### HTTP

```http
GET /v0/jobs?limit=3 HTTP/1.1
Host: api.luranta.com
Authorization: Bearer lur_...
Accept: application/json
```

### cURL

```shell
curl "https://api.luranta.com/v0/jobs?roles=software-engineering&limit=3" \
  --header "Authorization: Bearer $LURANTA_API_KEY" \
  --header "Accept: application/json"
```

## Scopes

| Scope | Allows |
| --- | --- |
| jobs:read | List and retrieve jobs |
| companies:read | List and retrieve companies |
| catalogues:read | Read taxonomies and bounded catalogues |

## Key lifecycle

- Name every key for its workload.
- Grant only required scopes.
- Rotate before expiry.
- Revoke immediately after suspected exposure.
- Never use API keys as browser sessions.