> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hollerith.monarcha.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and API keys

> Create and configure access

```sh theme={null}
export HOLLERITH_API_KEY="hk_live_YOUR_KEY"
export HOLLERITH_BASE_URL="https://hollerith.monarcha.ai"
```

Every request is authenticated with an API key scoped to one organization. The SDK reads those
two variables, and takes the same values as constructor arguments.

```python theme={null}
from hollerith import Hollerith

clf = Hollerith(
    api_key="hk_live_YOUR_KEY",
    base_url="https://hollerith.monarcha.ai",
)
```

## The base URL has no default

`HOLLERITH_BASE_URL` is required. With no `base_url=` argument and no environment variable, the
constructor raises a plain Python `ValueError` before any request is sent.

That `ValueError` is not a `HollerithError`, so an `except HollerithError` block will not catch
it. A missing key is different: that raises `AuthenticationError` with code `missing_api_key`.

The origin you point at proxies only `/v1/*` and `/sdk/*`. Everything else on that host is the
console, not the API.

## Create a key

* Sign in to the console and open API Keys.
* Create a key. It begins with `hk_live_`.
* Copy it. The plaintext is shown exactly once and is never retrievable again.

Store it in a secret manager or your shell environment. If you lose it, revoke it and create a
replacement.

Keys do not expire. One stays valid until you revoke it, and the console lists it by a masked
form such as `hk_live_••••3f9a` alongside the time it was last used.

## The placeholder ellipsis

Console snippets write the placeholder as `hk_live_…` with a single Unicode ellipsis character,
not three periods. Pasted unchanged, it is a syntactically valid string that matches no key, and
every call returns `invalid_api_key`.

Replace the whole placeholder, ellipsis included, with the key you copied.

Integrating from a language other than Python? The [REST API](/reference/rest-api)
documents the same calls on the wire.

## Rotate or revoke

Revoking a key disables it immediately; the next request with it returns `revoked_api_key`.
Create the replacement first if you want no gap in service.

Revoked keys are retained rather than deleted. This is deliberate — the row carries the
last-used timestamp, so revoking a key does not erase the record of what it did.

## One key, one organization

A key resolves to exactly one organization, and every read is scoped to that organization.
Reaching a job, fitted context or key belonging to another one returns `org_forbidden`.

Cross-organization access is never permitted and cannot be granted. To run against data another
organization owns, create a key there.

## Next

* [Errors](/reference/errors) — every code, the envelope fields, and the `requestId` to quote
* [Quickstart](/quickstart) — first prediction in about a minute
* [Limits and quotas](/reference/limits) — what your key is allowed to spend per day