> ## Documentation Index
> Fetch the complete documentation index at: https://docs.facetime.trychert.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication & API Keys

> Authenticate project-scoped server requests safely.

<Note>
  **Base URL**

  `https://facetime.trychert.com/api`
</Note>

<h2 id="project-keys">
  Project API keys
</h2>

`ftk_…` keys are bearer credentials for customer API access. Create them in **Developer → Project API keys**. Secrets are shown once, hashed at rest, and revocable at any time.

Use `facetime:read` for GET endpoints and `facetime:write` for mutations. Every request requires both headers:

```http theme={null}
Authorization: Bearer ftk_...
X-Chert-Project-Id: <your project UUID>
```

<h2 id="worker-keys">
  Worker credentials
</h2>

`ftw_…` credentials identify internal Chert infrastructure for heartbeats and call reporting. They are never issued to customers; the prefix is documented only so you can recognize it.

<h2 id="hygiene">
  Key hygiene
</h2>

* Keep API keys server-side and out of browser bundles.
* For Hosted Sessions, send only the short-lived LiveKit participant token to the browser.
* Rotate by creating a replacement, migrating traffic, then revoking the old key.
* Webhook signing secrets are separate from API keys.