> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useboom.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate with an organization API key.

All requests are made to the base URL `https://www.useboom.ai` and require an
organization API key, sent as a Bearer token:

```http theme={null}
Authorization: Bearer boom_org_xxxxxxxxxxxxxxxxxxxx
```

* The key identifies your organization. **You never pass an organization
  id**: it's derived from the key, and every request is scoped to it.
* Keys are prefixed `boom_org_` and are shown **once** at creation. Store
  the key securely; Boom only retains a hash.
* Revoking a key in the dashboard immediately rejects further requests
  with `401`.

<Warning>
  Treat API keys like passwords. Never embed them in client-side code,
  mobile apps, or public repositories. Use server-to-server calls only.
</Warning>

## Hosted environments

Boom exposes two hosted environments. Each has its own organizations and its own
API keys. A production key is not valid against the development host, and vice
versa.

| Environment | Base URL | Use |
| - | - | - |
| **Production** | `https://www.useboom.ai` | Live data and real journeys |
| **Development** | `https://dev.useboom.ai` | A sandbox for integration testing |

In the interactive API reference, switch the target with the **server
dropdown** at the top of each endpoint. In your own code, set the base URL once
(e.g. `export BASE="https://dev.useboom.ai/api/v1/cdp"`) so you can point the
same integration at either environment.

<Note>
  Not to be confused with the **environments you create inside an
  organization** to separate staging from production runs (see
  [Webhooks](/webhooks#environments)). Those are a journey-level concept: they
  scope runs, webhook subscriptions, and credentials — **not** API keys. A key
  is scoped to its organization and works across all of that organization's
  environments.
</Note>

## Errors

A `401` is returned with one of two messages depending on the failure mode:

| Status | `error` message | When |
| - | - | - |
| `401` | `Missing or malformed Authorization header` | The header is absent or not in `Bearer <key>` format |
| `401` | `Invalid or revoked API key` | The key failed verification (wrong key, or revoked) |

```json theme={null}
{ "error": "Invalid or revoked API key" }
```

## Related

<CardGroup cols={2}>
  <Card title="Quickstart" icon="rocket" href="/quickstart">
    Make your first authenticated calls end to end.
  </Card>

  <Card title="Rate limits & errors" icon="gauge-high" href="/rate-limits-and-errors">
    Per-key limits, headers, and the shared error shape.
  </Card>

  <Card title="One uniform surface" icon="layers" href="/one-surface">
    The same capabilities over REST and MCP.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.