# Authentication

> API keys for test and live data, rate limits and handling keys safely.

Every request to `/v1` and to the MCP server needs an API key in the `Authorization` header:

```http
GET /v1/organization HTTP/1.1
Host: api.ladehase.com
Authorization: Bearer lh_live_…
```

## Test and live keys

<table>
  <thead>
    <tr><th>Prefix</th><th>Data</th><th>Payments</th><th>Charging stations</th></tr>
  </thead>
  <tbody>
    <tr><td>`lh_test_`</td><td>Test data (`livemode: false`)</td><td>Test payments, no real money</td><td>Simulated test devices</td></tr>
    <tr><td>`lh_live_`</td><td>Live data (`livemode: true`)</td><td>Real payments via zahls.ch or Freika</td><td>Your connected charging stations</td></tr>
  </tbody>
</table>

Test and live data are fully separated. A test key never sees live data and vice versa.

## Create keys

Create keys in the dashboard under «Developers» and give them a name so you recognise them later. The full key is shown only once. Store it in a password manager or in your application's environment variables.

> **Achtung:** Treat live keys like passwords. Never put them in source code, front ends or public repositories. If a key is compromised, revoke it immediately in the dashboard.

## Rate limit

Each key has a per-minute limit (600 requests by default). Every response contains the headers `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset`. If you exceed the limit, the API responds with `429` and the code `rate_limited`. The `Retry-After` header tells you how many seconds to wait.

## Organisations

A key always belongs to exactly one organisation. If you work for several organisations (for example as an installer), create one key per organisation.

## Authentication errors

<table>
  <thead>
    <tr><th>Status</th><th>Code</th><th>Meaning</th></tr>
  </thead>
  <tbody>
    <tr><td>401</td><td>`unauthorized`</td><td>Key is missing, invalid or revoked.</td></tr>
    <tr><td>403</td><td>`forbidden`</td><td>The key may not perform this action or the feature is not enabled for the organisation.</td></tr>
  </tbody>
</table>