> ## Documentation Index
> Fetch the complete documentation index at: https://docs.permitcore.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Missing credentials

> 401 — the request had no Authorization: Bearer <key> header. How to fix it.

Your request reached the API without an `Authorization` header, so it was
rejected before any work was done.

```http theme={null}
GET /v1/permits HTTP/2
Host: api.permitcore.io
```

```json 401 application/problem+json theme={null}
{
  "type": "https://docs.permitcore.io/errors/missing-credentials",
  "title": "Missing Credentials",
  "status": 401,
  "detail": "Missing Authorization: Bearer <key> header.",
  "instance": "/v1/permits",
  "request_id": "req_1f07fb45782b445e9f6312ba23921234"
}
```

Every PermitCore endpoint requires a key. Unauthenticated requests always
return this error — there is no anonymous access tier.

## Fix it

<Steps>
  <Step title="Get an API key">
    Sign in at [permitcore.io/account/api-keys](https://permitcore.io/account/api-keys)
    and create a key. The plaintext key is shown **once** at creation — copy it
    then. Don't have an account yet? [Start free](https://permitcore.io/signup)
    (no card, 1,000 requests/month).
  </Step>

  <Step title="Send it as a Bearer token">
    Pass the key in the `Authorization` header on every request:

    ```bash theme={null}
    curl https://api.permitcore.io/v1/permits \
      -H "Authorization: Bearer $PERMITCORE_API_KEY"
    ```

    The header name is `Authorization` and the scheme is `Bearer` — a bare key,
    a query parameter, or any other header will still return this error.
  </Step>
</Steps>

## Common causes

* The `Authorization` header was dropped by a proxy, or never set by your HTTP
  client.
* The key was placed in the URL or a custom header instead of `Authorization`.
* An environment variable holding the key was empty at request time.

<Card title="Make your first authenticated call" href="/quickstart" icon="rocket">
  The quickstart walks through creating a key and calling `/v1/permits`
  end to end.
</Card>

See also [Authentication](/authentication) and the full [error catalog](/errors).
Every response carries an `x-request-id` header — include it in any support
request.