# Auth & keys

Fivexer has two credential planes. Using the right key for the right call keeps your integration simple and least-privileged.

## Workspace plane (`sk_` keys)

Server-to-server integrations use a workspace API key:

- `sk_test_...` — sandbox workspace; safe to embed in CI and local dev.
- `sk_live_...` — production workspace; treat as a secret.

Pass the key to the SDK constructor:

```
pythonfrom fivexer import Fivexer
client = Fivexer(base_url="https://api.fivexer.com", api_key="sk_test_...")
```

Every workspace-plane response parses `X-Quota-*` headers onto `client.quota`.

## Worker portal plane (`wt_` tokens)

A worker-facing UI logs in with `POST /worker/auth/login` (or `worker.auth.login()` in the SDK) using a workspace ID, worker ID, and PIN. The response contains a `wt_...` session token scoped to that single worker.

Use the worker client to:

- view the worker's own queue
- accept/reject/complete assigned tasks
- start and end breaks

```
pythonfrom fivexer import FivexerWorker, WorkerLogin

worker = FivexerWorker(base_url="https://api.fivexer.com")
worker.login(WorkerLogin(workspace_id="ws_1", worker_id="agent_1", pin="4821"))
worker.accept(worker.queue().task_ids[0])
```

Worker-plane calls do **not** parse quota headers and do **not** send idempotency keys.

## Key rotation

You can create and revoke keys from the workspace console. Rotating a key does not affect in-flight tasks or worker sessions.