> ## Documentation Index
> Fetch the complete documentation index at: https://secndai.manicule.dev/llms.txt
> Use this file to discover all available pages before exploring further.
> For every page in one file, fetch https://secndai.manicule.dev/llms-full.txt (large).
> To search and read these docs as tools, connect the MCP server at https://secndai.manicule.dev/api/mcp.
> Every agent surface: https://secndai.manicule.dev/.well-known/llms-manifest.json

# Authentication (/authentication)

<!-- agent-signals: reading_time_min: 1 · est_tokens: 229 · updated: 2026-11-12 -->
Related: [Introduction](/index.md), [Quickstart](/quickstart.md), [Models](/models.md), [Changelog](/changelog.md), [Confidence and the gate](/confidence.md), [Request limits](/limits.md)

> Keep bearer keys on your server.

Create a key in the Secnd console at `/dashboard`. Copy the secret when it is first shown; later views show only its prefix. Keep it in your server's secret store as `SECND_API_KEY`.

Send this header to both `POST /v1/decide` and `GET /v1/models`:

```http
Authorization: Bearer <SECND_API_KEY>
```

Never embed a key in browser JavaScript, mobile binaries, a public repository, or a docs playground shared with another person. Your browser should call your own backend, which supplies the key.

## Rotate or revoke

Create a replacement, update your server's secret, verify one request, then revoke the old key in the console. If a key is exposed, revoke it immediately. A revoked key receives `401`; retries cannot fix it.

API keys authorize inference. Console sign-in is separate and does not replace a bearer key in API requests. Dashboard administration is account-scoped.