> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qoory.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and API keys

> Handle bearer authentication, scopes, storage, rotation, and revocation.

The Developer API is in limited beta. An API key belongs to one Qoory user and
uses that user's Developer access and credit balance.

## Bearer authentication

Send the secret in the `Authorization` header on every REST and remote MCP
request:

```http theme={null}
Authorization: Bearer qoory_live_...
```

Qoory never accepts API keys in URLs. Query strings can be recorded by browsers,
proxies, and analytics systems.

## Scopes

| Scope         | Purpose                                                 |
| ------------- | ------------------------------------------------------- |
| `search:read` | Search, resolution, and bounded discovery operations.   |
| `data:read`   | Entity details and bounded entity subresources.         |
| `usage:read`  | Key-owned usage and credit information where supported. |

Choose the narrowest scopes the integration needs. A valid key without the
required scope receives `FORBIDDEN` and does not gain access through MCP or a
Skill.

## Key lifecycle

1. **Create:** name the key for one environment or integration and select its
   scopes.
2. **Store:** put the secret in the deployment platform's secret store or a
   local environment variable excluded from version control.
3. **Rotate:** create a replacement, deploy it, confirm traffic uses it, then
   revoke the old key.
4. **Disable:** temporarily stop a key while preserving its record and usage
   history.
5. **Revoke:** permanently invalidate a key that is retired or suspected to be
   exposed.

Key lists show safe identifiers such as name, prefix, scopes, state, and recent
use. They never return the complete secret after creation.

## Client-side applications

Do not call Qoory directly from untrusted browser or mobile code with a private
key. Put the key behind your own server and expose only the operations and data
your application needs. Allowed browser origins for MCP do not turn a bearer
key into a public credential.