# Auth & API keys

Every request to the submit endpoint needs an API key. Pass it in one of three ways:

- **Header (preferred):** `x-api-key: fr_live_...`
- **Bearer fallback:** `Authorization: Bearer fr_live_...`
- **Form field (no-JS HTML forms):** a hidden `_api_key` input. Plain forms can't set headers. The field is stripped before the payload is stored, but it is visible in your page source. A browser fetch call also exposes the key. Use a server proxy to keep it private.

Keys start with `fr_live_` followed by 22 URL-safe characters. Only the SHA-256 hash is stored server-side. You can rotate or revoke a key any time from [/app/keys](https://forms.devxgroup.io/app/keys). Rotating creates a new key; the old one stops working immediately.