> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mithunai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate API requests with a key

> Send your API key as a bearer token on every request. Which credentials exist, what each may do, and which routes refuse a key and need a console session.

Authenticate every request with an API key in the `Authorization` header:

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl "$MITHUNAI_URL/arukz/api/v1/assistants" \
  --header "Authorization: Bearer arukz_sk_..."
```

API keys start with `arukz_sk_`. Owners and Administrators create them in the console under **Operations → API keys**. The secret is shown once. See [API keys](/administration/api-keys) for creating, rotating and revoking keys.

## What a key can do

A key holds one [role](/concepts/organizations-and-roles) and can do exactly what a person with that role can do, in the organisation it was created in.

* A key always acts in its own organisation. It cannot reach another.
* Its role is fixed when it is created. To change it, create a new key and revoke the old one.
* A key **cannot** manage API keys, whatever its role. The [API key endpoints](/api-reference/api-keys/create-api-key) require a signed-in console session.

## Other credentials

| Credential               | Header                    | Used for                                                                                    |
| ------------------------ | ------------------------- | ------------------------------------------------------------------------------------------- |
| API key, `arukz_sk_…`    | `Authorization: Bearer …` | Almost every endpoint, and the [MCP server](/channels/mcp)                                  |
| Console session          | Browser cookies           | The console. API key management requires it                                                 |
| Widget key, `arukz_wk_…` | `X-ARUKZ-Widget-Key`      | Only the public [widget endpoints](/api-reference/widget/bootstrap), from an allowed origin |
| Visitor token            | `X-ARUKZ-Visitor-Token`   | Widget conversation endpoints, together with the widget key                                 |

A widget key is not accepted where an API key is expected, and an API key is not accepted on the widget endpoints.

`GET /health` and `GET /ready` need no credential.

## Authentication errors

| Status | Code                   | Meaning                                                                                              |
| ------ | ---------------------- | ---------------------------------------------------------------------------------------------------- |
| `401`  | `authentication_error` | The key is missing, malformed, unknown, revoked or expired. These cases look identical, deliberately |
| `403`  | `authorization_error`  | The key is valid, but its role does not allow the action                                             |
| `404`  | `not_found`            | The resource does not exist in your organisation                                                     |

<Warning>
  Never embed an API key in a browser, a mobile app or a public repository. If a key leaks, revoke
  it immediately; revocation takes effect on the next request.
</Warning>