# Authentication Every request carries Authorization: Bearer sg_... Keys are stored only as hashes, shown once at creation, and can be revoked from the dashboard at any time. Create a second key, deploy it, then revoke the first. No forced 90-day expiry applies. Never put a key in browser code or a public repository. Everything else returns 401 without a valid key.Checked on 2026-11-12.Official source: [RFC 6750 Bearer tokens](https://datatracker.ietf.org/doc/html/rfc6750) | Header | Authorization: Bearer | | --- | --- | | Prefix | sg_ | | Storage | Hash only | | Shown | Once | ## Send the key ``` curl "https://samgovapi.io/api/v1/entities/ABCDEFGH1234" \ -H "Authorization: Bearer sg_YOUR_KEY" ``` ## Rotate Create a second key, deploy it, then revoke the first. No forced 90-day expiry applies. ## Keep it secret Never put a key in browser code or a public repository. ## Keyless calls A few routes need no key: the agent sign-up endpoints, the feedback endpoint and the MCP search and fetch tools, which let an agent try the data before its user approves a key. Everything else returns 401 without a valid key. ## Related - [Quickstart](https://samgovapi.io/docs/quickstart) - [Errors](https://samgovapi.io/docs/errors)Updated 2026-11-12. Sources checked 2026-11-12.Independent. Not affiliated with, endorsed by or sponsored by GSA, SAM.gov or any U.S. government agency. Registering in SAM.gov is free at sam.gov.

---

HTML version: https://samgovapi.io/docs/authentication . Markdown: https://samgovapi.io/docs/authentication.md

Independent. Not affiliated with, endorsed by or sponsored by GSA, SAM.gov or any U.S. government agency. Registering in SAM.gov is free at sam.gov.

Get a free API key: https://samgovapi.io/sign-up?ref=ai-claudebot