mivia / docs / authentication

Authentication

Every call carries one bearer key. REST and MCP use the same key against the same balance.

The header

Authorization: Bearer mivia_<key-id>_<secret>

A key is one string with three parts:

• the literal prefix mivia_
• a 16 character key id, shared with the dashboard row
• a secret, shown once at mint and rotate time

Keep the secret

• store it in an environment variable or a secret manager, never in source control
• the dashboard shows the secret half exactly once; copy it then
• rotate burns the old secret at once and hands you a new one; wire rotation into your deploy, not into an incident
• a leaked key should be rotated or deleted from the dashboard the moment you see it

Failure behavior

A missing, malformed, or unknown key answers:

{"detail": "invalid api key"}

with status 401. There is no distinction between the cases on the wire; treat any 401 as "fix the key". The full status code list lives on the errors page.

Session sign-ins from the dashboard can call the api without a key; the session stands in for the bearer. Machine callers always use a key.