> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aflux.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API authentication

> One header, one key.

Every authenticated endpoint takes an API key as a bearer token:

```bash theme={null}
curl "https://backend.aflux.ai/api/v1/users/me" \
  -H "Authorization: Bearer sk-af-v1-a1b2c3d4e5f6…"
```

Create the key in the console under **Settings → API keys**, or through [the API](/account/api-keys). The same key authenticates the [MCP server](/mcp/overview).

## What does not need a key

A handful of endpoints are public because they are how an account comes into existence in the first place: registration, e-mail confirmation, sign-in, token refresh, the password-reset pair, and the OAuth entry points. Everything else requires a key.

## What a missing or bad key gets you

A request with no credentials, an unknown key, a disabled key or an expired one is refused with **`401`**. There is no partial access and no anonymous read: the tool catalogue, the endpoint list and every object behind them all require a valid key.

<Warning>
  A key carries your account's full authority, including spending your balance. Send it in the `Authorization` header only — never in a query string, where it would be written to logs and browser history.
</Warning>

## Sessions

The console signs people in with sessions rather than API keys, and those tokens travel in the same `Authorization` header. See [Sign-in and account security](/account/authentication) if you are building against that flow instead.