# Authentication — Compliance Intelligence Hub API

## Method

Bearer API key on every request:

```
Authorization: Bearer cih_live_xxx
```

- Keys are issued per subscriber (early access: by contact — mjuhanson13@gmail.com).
- Keys are **scoped per source channel** (e.g. CMS-only, Federal Register-only,
  or all channels). A request outside your key's scope returns `403` with a
  `scope` explanation. See `/pricing.json` for channels.
- Only hashes of keys are stored server-side.

## Endpoints that require auth

Everything under `/api/v1` except `GET /api/v1` (the index) and
`GET /api/v1/health`.

## Rate limits

Per key; `429` with `Retry-After` when exceeded. Default 60 req/min.

## For agents

- Keep the key server-side (MCP server env: `CIH_API_KEY`); never expose it in
  browser contexts.
- Verify citation integrity via each update's `content_sha256`.