# Keys and authorization

Every API request is signed with a key that looks like `dtk_…`.

## How to pass the key

In the `Authorization` header:

```http
Authorization: Bearer dtk_your_key
```

or in the `X-API-Key: dtk_your_key` header.

## Who owns the key

A key belongs to an organization: its plan, limits and the private channels it has verified. An organization has as many keys as its plan allows: Test — 1, Start — 2, Growth — 5, Profi — 20.

## Key permissions

When creating a key on the “API keys” page you can tick **“Read and write”**. Without it the key only reads data — enough for every method except webhook management. Only a “read and write” key can create, change and delete webhooks; a key without the mark gets `403 read_only_key`. The mark can’t be changed later — create another key.

The same key connects the [MCP server](/en/api/mcp/) for AI assistants: the assistant uses requests just like your code.

## When a key stops working

- The key was revoked on the “API keys” page.
- The member was removed from the organization — their keys are revoked.
- The member is paused (not enough seats on the plan) or the organization is archived — keys are suspended and work again once access returns.

!!! warning
    Do not publish your key in code on GitHub or in browser scripts: anyone with it can spend your organization’s limit.