# Authentication

Every call carries one bearer key. REST and MCP use the same key
against the same balance.

## The header

```http
Authorization: Bearer mivia_<key-id>_<secret>
```

A key is one string with three parts:

- the literal prefix `mivia_`
- a 16 character key id, shared with the dashboard row
- a secret, shown once at mint and rotate time

## Keep the secret

- store it in an environment variable or a secret manager, never in
  source control
- the dashboard shows the secret half exactly once; copy it then
- rotate burns the old secret at once and hands you a new one; wire
  rotation into your deploy, not into an incident
- a leaked key should be rotated or deleted from the dashboard the
  moment you see it

## Failure behavior

A missing, malformed, or unknown key answers:

```json
{"detail": "invalid api key"}
```

with status 401. There is no distinction between the cases on the
wire; treat any 401 as "fix the key". The full status code list
lives on the [errors](/docs/errors) page.

Session sign-ins from the dashboard can call the api without a key;
the session stands in for the bearer. Machine callers always use a
key.