> ## Documentation Index
> Fetch the complete documentation index at: https://docs.policymate.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create an organisation API key, send it with every request, and control which workspaces it can read.

## Creating API Keys

The PolicyMate API authenticates requests using API keys. An API key belongs to your organisation rather than to a person, so it keeps working as people join or leave your team.

Organisation admins may create keys from the **API Keys** screen of PolicyMate's settings. When creating a key, you give it a name, such as "Data warehouse", and choose the workspaces it may read. The key itself is only displayed once, so you should store it somewhere safe immediately.

## Making Authenticated Requests

When making requests, include the key in the `Authorization` header as a `Bearer` token. You should also send an `Accept: application/json` header so that errors are returned as JSON:

```http theme={null}
GET /api/v0/bills HTTP/1.1
Host: app.policymate.io
Accept: application/json
Authorization: Bearer <your-api-key>
```

## What an API Key May Access

The API is read-only. An API key may read every bill, document, and other record in the jurisdictions and sources your organisation has access to. Workspaces, topics, and recommendations are only available for the workspaces chosen for that key.

When choosing workspaces, an admin may select any shared workspace in the organisation, along with any private workspace the admin is a member of. Personal workspaces are never available to API keys. Every workspace a key can read lists that key in its settings, so its members always know which systems can see it.

> [!NOTE]
>
> To change topics, preferences, or feedback on recommendations, use the PolicyMate app or the MCP connector. The API never changes your workspaces.

## Managing API Keys

From the same settings screen, admins may change the workspaces a key can read at any time, and the change applies to the key's very next request. Admins may also rotate a key, which issues a new key and invalidates the old one, or revoke it entirely. Revoked and rotated keys stop working immediately.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.