> ## Documentation Index
> Fetch the complete documentation index at: https://help.abacusdocs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign in and API keys

> Auth0 Universal Login for the web app, and one sk-abacus-* API key per organization.

## Web sign-in

The app sends you to **Auth0 Universal Login** at `/auth/login/`. After you authenticate, Auth0 returns you to Abacus Docs and a session is created.

* There is no email-and-password form on abacusdocs.com.
* There is no Account Settings page for passkeys or two-factor configuration. Those options, if offered, live on the Auth0 login screen.
* Sessions last **30 days of idle time**. Each request refreshes the idle window, so an account you use daily does not expire on its own.

<Tip>
  Bookmark [abacusdocs.com/app](https://abacusdocs.com/app) (My Documents). If you are signed out, you will be sent through Auth0 and back to the same page.
</Tip>

## API keys

Programmatic access uses an organization API key, not your Auth0 session.

1. Open **API** in the sidebar (`/api/`), or go directly to `/api/keys/`.
2. Generate a key. The raw secret is shown **once** and starts with `sk-abacus-`.
3. Copy it immediately. You cannot retrieve the full value later.

An organization can have **one active key** at a time. Generating a new key replaces the previous one. Revoking the key stops every integration that used it.

<Warning>
  Treat the key as a secret. Anyone who holds it can act as the organization on the API. Removing a person from the organization does **not** revoke the key — revoke it on `/api/keys/`.
</Warning>

Send the key as a Bearer token on the same host as the web app (`abacusdocs.com`), not on a separate `api.abacusdocs.com` hostname.

```bash theme={null}
curl -H "Authorization: Bearer sk-abacus-..." \
  https://abacusdocs.com/api/v2/documents/
```

See the **API Reference** tab for request and response shapes. That tab is being rebuilt to match the live OpenAPI; until then, treat the key and host above as the source of truth for authentication.

## Who can manage keys

On an individual account, the owner can mint and revoke the key. On an enterprise organization, a moderator (Owner or Admin) or a staff operator can.