> ## Documentation Index
> Fetch the complete documentation index at: https://docs.boxpressd.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate Boxpressd API requests with developer keys and OAuth access tokens.

Boxpressd uses two credentials with separate purposes.

| Credential         | Identifies                          | Required for                       |
| ------------------ | ----------------------------------- | ---------------------------------- |
| Developer key      | Your developer application          | Every REST and GraphQL request     |
| OAuth access token | A Boxpressd user and granted scopes | User-specific fields and resources |

## Developer keys

Send your application key in the `x-boxpressd-key` header:

```http theme={null}
x-boxpressd-key: bxp_test_replace_me
```

Create, rotate, and revoke keys in your application’s **Credentials** page at [developers.boxpressd.com](https://developers.boxpressd.com). Development keys use the `bxp_test_` prefix. Production keys require an approved application when production approval is enabled.

The full key appears only when you create or rotate it. Rotating a key revokes the prior key immediately.

<Warning>
  A developer key is an application-wide secret. Keep it on a backend or backend-for-frontend. Native and browser bundles cannot protect it.
</Warning>

## OAuth access tokens

For connected-user requests, include the developer key and the user’s Bearer token:

```http theme={null}
x-boxpressd-key: bxp_test_replace_me
Authorization: Bearer eyJ...
```

For example, `GET /v1/me` requires `profile:read`. Its `email` field appears only when the token also has `email:read`.

```bash theme={null}
curl "https://api.boxpressd.com/v1/me" \
  --header "x-boxpressd-key: $BOXPRESSD_DEVELOPER_API_KEY" \
  --header "Authorization: Bearer $BOXPRESSD_ACCESS_TOKEN"
```

See [OAuth](/developer-api/oauth) for Authorization Code + PKCE setup and the current scope list.

## Rate limits

The default application policy sustains 60 requests per minute with a burst capacity of 20. Your plan or application can override this policy.

REST responses include `ratelimit-limit` and `ratelimit-remaining`. A `429` response also includes `retry-after`.

## Authentication errors

| Status | Error                         | Meaning                                                       |
| ------ | ----------------------------- | ------------------------------------------------------------- |
| `401`  | `developer_key_required`      | The `x-boxpressd-key` header is missing.                      |
| `401`  | `invalid_developer_key`       | The key is invalid, inactive, revoked, or expired.            |
| `401`  | `oauth_access_token_required` | The route requires a user access token.                       |
| `401`  | `invalid_oauth_access_token`  | The OAuth token is invalid or expired.                        |
| `403`  | `insufficient_scope`          | The token does not grant the required scope.                  |
| `429`  | `rate_limit_exceeded`         | The application or authentication-attempt limit was exceeded. |