Authenticate API requests with a key - MITHUNAI Docs

Authenticate every request with an API key in the Authorization header:

curl "$MITHUNAI_URL/arukz/api/v1/assistants" \
  --header "Authorization: Bearer arukz_sk_..."

API keys start with arukz_sk_. Owners and Administrators create them in the console under Operations → API keys. The secret is shown once. See API keys for creating, rotating and revoking keys.

What a key can do

A key holds one role and can do exactly what a person with that role can do, in the organisation it was created in.

A key always acts in its own organisation. It cannot reach another.
Its role is fixed when it is created. To change it, create a new key and revoke the old one.
A key cannot manage API keys, whatever its role. The API key endpoints require a signed-in console session.

Other credentials

Credential	Header	Used for
API key, `arukz_sk_…`	`Authorization: Bearer …`	Almost every endpoint, and the MCP server
Console session	Browser cookies	The console. API key management requires it
Widget key, `arukz_wk_…`	`X-ARUKZ-Widget-Key`	Only the public widget endpoints, from an allowed origin
Visitor token	`X-ARUKZ-Visitor-Token`	Widget conversation endpoints, together with the widget key

A widget key is not accepted where an API key is expected, and an API key is not accepted on the widget endpoints. GET /health and GET /ready need no credential.

Authentication errors

Status	Code	Meaning
`401`	`authentication_error`	The key is missing, malformed, unknown, revoked or expired. These cases look identical, deliberately
`403`	`authorization_error`	The key is valid, but its role does not allow the action
`404`	`not_found`	The resource does not exist in your organisation

Never embed an API key in a browser, a mobile app or a public repository. If a key leaks, revoke it immediately; revocation takes effect on the next request.

Last modified on September 26, 2026

⌘I