# Authentication

Every request to the HTTP API authenticates with a Bearer API key. Send it in the
`Authorization` header:

```bash
curl https://appmanai.com/api/v1/resources/countries \
  -H "Authorization: Bearer appmanai_live_xxx"
```

A missing, malformed, or revoked key returns `401 UNAUTHORIZED` in the
[unified error shape](https://appmanai.com/docs/guide/errors.md).

## Creating and rotating keys

Manage keys from your [dashboard](https://appmanai.com/app):

- The secret is shown **once**, at creation time. Store it somewhere safe — the
  dashboard only ever shows a masked prefix afterward.
- We store keys **hashed**; we can't recover a lost secret, only replace it.
- Rotating (regenerating) a key **revokes the old secret immediately**. Any
  client still using it starts getting `401` right away, so roll the new value
  out first.

You never handle the data engine's own credentials — the platform validates your
Bearer key and calls the engine on your behalf.

## Interactive clients (MCP)

Agents like Claude and Cursor don't paste a key at all — they connect over OAuth
through the [MCP server](https://appmanai.com/docs/guide/mcp.md) and sign in through the browser. Use Bearer
keys for scripts and back-end integrations; use MCP for agents.