# Authentication

> Solarium docs. All requests are `POST https://api.trysolarium.com/graphql/` with `Authorization: Bearer <api key>` and a JSON body `{"query": ..., "variables": ...}`. Every query and mutation takes an `organizationId` (find it with `myOrganizations`). Index of all pages: https://trysolarium.com/llms.txt

Authenticate by passing your API key as a Bearer token in the Authorization header.

API keys are created in the Solarium dashboard at **Settings > API Keys**. API keys start with `sol_` and are shown once at creation. Store them securely. Only the SHA-256 hash is stored on our end.

API keys are scoped to a single organization. You cannot access another organization's data with an API key. Admin operations (managing members, creating other API keys) are not available via API key.

### Rate Limiting

API key requests are limited to **5,000 requests per hour** per API key. The limit resets on a rolling 1-hour window from the first request.

Every API key response includes rate limit headers:
- `X-RateLimit-Limit`: your hourly quota (5000)
- `X-RateLimit-Remaining`: requests left in the current window

If you exceed the limit, requests return **429 Too Many Requests** with a `Retry-After` header. JWT-authenticated requests (dashboard sessions) are not rate limited.

## Example

```
# API Key auth (recommended for integrations)
curl -X POST https://api.trysolarium.com/graphql/ \
  -H "Authorization: Bearer sol_abc123..." \
  -H "Content-Type: application/json" \
  -d '{"query": "{ myOrganizations { id name } }"}'

# JWT auth (for user sessions)
curl -X POST https://api.trysolarium.com/graphql/ \
  -H "Authorization: JWT eyJhbGciOiJIUzI1NiIs..." \
  -H "Content-Type: application/json" \
  -d '{"query": "{ myOrganizations { id name } }"}'
```

## Example Response

```
# Unauthenticated request
{
  "errors": [
    { "message": "Authentication Required." }
  ]
}

# Wrong Organization
{
  "errors": [
    { "message": "API Key Not Authorized For This Organization." }
  ]
}

# Rate limit exceeded (429)
{
  "errors": [
    { "message": "Rate Limit Exceeded. 5,000 Requests/Hour." }
  ]
}
# Headers: Retry-After: 60
```