> For the complete documentation index, see [llms.txt](https://docs.roboflow.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.roboflow.com/reference/authentication/authentication.md).

# Authentication

Every request to the Roboflow API and to Roboflow Inference is authenticated. This section explains the credential types Roboflow offers, when to use each, and where to find the IDs your requests need.

{% hint style="info" icon="key" %}
Find your API key at [app.roboflow.com/settings/api](https://app.roboflow.com/settings/api).
{% endhint %}

## Credential types

Roboflow supports several kinds of credentials, each suited to a different context:

* **Private API key** - the default workspace credential. It grants full access to your workspace's data, models, and projects, so treat it like a password and keep it server-side. Use it for the [REST API](/reference/rest-api/rest-api/using-the-rest-api.md), [Python SDK](/reference/python-sdk/python-sdk/using-the-python-sdk.md), [CLI](/reference/cli/cli/using-the-cli.md), and self-hosted [Inference](https://inference.roboflow.com/). See [Find Your Roboflow API Key](/reference/authentication/authentication/find-your-roboflow-api-key.md).
* **Publishable key** - a non-secret credential of the form `rf_<workspaceId>`, safe to embed in browser or edge code such as [inferencejs](https://docs.roboflow.com/deployment/self-hosted/sdks/web-browser). It is inference- and model-download-only and cannot be rotated or revoked because it is derived from the workspace ID. See [The Publishable Key](/reference/authentication/authentication/manage-api-keys.md#the-publishable-key).
* **Scoped API keys** - Enterprise credentials restricted to specific permissions (for example, run inference but not manage models) and optionally to specific project folders. See [Scoped API Keys](/reference/authentication/authentication/scoped-api-keys.md).
* **OAuth 2.1 (Sign in with Roboflow)** - let users sign in to your application with their Roboflow account and grant your app scoped access on their behalf, using the authorization-code flow with PKCE. See [Sign In With Roboflow (Getting Started)](/reference/authentication/authentication/sign-in-with-roboflow-getting-started.md).

## Managing keys

* [Find Your Roboflow API Key](/reference/authentication/authentication/find-your-roboflow-api-key.md) - where your key lives, private vs. publishable, and rolling a compromised key.
* [Manage API Keys](/reference/authentication/authentication/manage-api-keys.md) - create, list, update, protect, disable, and revoke keys programmatically via the REST API, the `roboflow api-key` CLI, or the MCP server.
* [Scoped API Keys](/reference/authentication/authentication/scoped-api-keys.md) - issue Enterprise keys limited to specific permissions.

## Sign in with Roboflow (OAuth)

* [Sign In With Roboflow (Getting Started)](/reference/authentication/authentication/sign-in-with-roboflow-getting-started.md) - register an OAuth app, run the PKCE flow, exchange and refresh tokens, and the full list of scopes.
* [Sign In With Roboflow (Developer Reference)](/reference/authentication/authentication/sign-in-with-roboflow-developer-reference.md) - endpoints, hosts, visibility, token endpoint authentication, errors, and a runnable example app.
* [OAuth 2.1 (Sign in with Roboflow)](/reference/authentication/authentication/oauth.md) - legacy landing page that points to the two guides above.

## Finding your IDs

Most API calls need more than a key - they need to know which workspace, project, and model version to act on.

* [Workspace and Project IDs](/reference/authentication/authentication/workspace-and-project-ids.md) - retrieve the project ID and model version number used in inference and API requests.

For the header and query-parameter formats accepted on each host, see [Authenticate with the REST API](/reference/rest-api/rest-api/authenticate-with-the-rest-api.md).