# Authentication

> **Warning:** Since September 25, 2026, new school API keys can no longer be created. Integrations that already have a key keep using it. New integrations must use [API v3](https://cademi.dev/api/authentication.md), which has its own credentials.

Every call carries the school API key in the `Authorization` header. The `Bearer` prefix is optional.

```http
GET /api/v1/usuario
Host: yourschool.cademi.com.br
Authorization: Bearer 4cc58d97-14c2-406f-a8c5-1ebb8e05696d
```

The key identifies the school: it answers for that school's data on any Cademí address. It is valid for the whole school, with no per-integration permissions. Deleting it in the dashboard revokes it immediately.

Without the header, or with a key that does not exist or was deleted, the answer is HTTP 401:

```json
{ "code": 401, "success": false, "message": " Invalid api key" }
```

Keys of [API v3](https://cademi.dev/api.md) do not work here, and v1/v2 keys do not work on v3.