# Authentication

## Create a key

Keys are created in the app, never through the API: open **Settings, Team, API keys** and create one. A key belongs to one team and acts only on that team. Pick a preset:

| Preset | Abilities |
|---|---|
| Read only | every `:read` ability: monitors, metrics, incidents, status pages, channels, on-call, maintenance, stats, team |
| Read and write | read only, plus `monitors:write`, `metrics:write`, `incidents:write`, `maintenance:write` |
| Full | read and write, plus `status_pages:write`, `channels:write`, `oncall:write` |

`team:manage` (changing members and invitations) is never part of a preset; grant it on its own. The secret (`upz_...`) is shown once, when the key is created. Store it like a password. A key can also carry an expiry date. The number of keys a team may hold depends on its plan.

## Authenticate

Send the key as a bearer token on every request:

```
curl https://api.uptizm.com/v1/me \
  -H "Authorization: Bearer upz_..." \
  -H "Accept: application/json"
```

`GET /me` works with any valid key. It returns the team, its plan and limits, and the key's name, abilities, expiry and kind: the quickest way to check what a key can do.

Every endpoint names the ability it needs, in its page and as `x-required-ability` in the spec. A key without it gets a 403 that names the missing ability (see [Errors](https://uptizm.com/docs/errors.md)).