# Key

URL: /callers/keys · Id: `term:key`

> The credential a Customer presents on a call; the platform checks it on every call and never stores it.

A Key is the credential a Customer presents on a call; the platform checks it on every call and never stores it.

## Kinds
| Kind | Calls and usage |
| --- | --- |
| `live` | Calls and usage post to the books of the Startup. |
| `test` | Calls and usage stay in the test namespace, whose books never post. |
| `dev` | Calls and usage stay in the dev namespace, whose books never post. |

## Checks
Every call passes these gates in order before it runs. A refused call is free.

| Gate | Checks | Status | Codes |
| --- | --- | --- | --- |
| `key-valid` | A presented Key is a credential the platform accepts. | 401 | [`invalid_key`](/evidence/errors/invalid_key) |
| `key-required` | A call presents a Key when the Offer requires one. | 401 | [`key_required`](/evidence/errors/key_required) |
| `entitled` | The Entitlement of the Key covers the operation. | 403 | [`not_entitled`](/evidence/errors/not_entitled) |
| `placed` | The Customer resolves, and its calls have a namespace to live in. | 503 | [`customer_unresolved`](/evidence/errors/customer_unresolved), [`customer_unplaced`](/evidence/errors/customer_unplaced) |
| `within-limit` | The call fits under every Limit, which it reserves before it runs. | 403 | [`limit_exceeded`](/evidence/errors/limit_exceeded) |
| `limits-checkable` | The Limits can be checked at all; when they cannot, nothing runs. | 503 | [`limits_unavailable`](/evidence/errors/limits_unavailable) |

## Guarantees
- **A Limit is never skipped.** When the Limits cannot be checked, the call answers 503 and nothing runs.
- **A test call never touches live books.** A test or dev Key keeps its calls and usage in a separate namespace whose books never post.

## Example
```bash title="A test call to the Openhours sample"
curl https://openhours.example/places/pl_4821/hours \
  -H "X-Api-Key: $OPENHOURS_TEST_KEY"
```