# Authentication

Every call carries the school API key, created in the dashboard settings, in the `Authorization` header. The `Bearer` prefix is optional. It is the same key as [API v1](https://cademi.dev/legacy/v1/guides/authentication.md).

```http
GET /api/v2/user/email:maria@exemplo.com/access
Host: yourschool.cademi.com.br
Authorization: Bearer 4cc58d97-14c2-406f-a8c5-1ebb8e05696d
```

The key identifies the school and is valid for the whole school. Deleting it in the dashboard revokes it immediately. Without the header, or with a key that does not exist or was deleted, the answer is HTTP 401:

```json
{ "code": 401, "success": false, "message": " Invalid api key" }
```