> ## Documentation index
> Fetch the complete documentation index at: https://rankfield.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate every Rankfield API request with your API key in the Authorization header, and keep the key safe.

## Send the key

Every endpoint under `https://rankfield.dev/v1/` and the [MCP server](/docs/agents/mcp-server) need the key in the `Authorization` header:

```http
Authorization: Bearer ls_your_key
```

The same key works for every endpoint. Get one from the [API key panel](/?tab=key#playground). Keys do not expire.

## When the key is missing or wrong

The answer is `401` with a `WWW-Authenticate: Bearer` header. Check that the header reads exactly `Bearer ` followed by the key, with no quotes or line break.

```json 401
{
  "error": {
    "message": "A valid API key is required"
  }
}
```

## Get a key from code

Agents and scripts can ask for a key without a browser:

```bash
curl -sS -X POST https://rankfield.dev/v1/keys -H 'Origin: https://rankfield.dev'
```

The `Origin` header is required. Reuse one key rather than asking for a new one per run. When key issuance is at capacity, the answer is `429`; try again later.

## Keep your key safe

- Load it from an environment variable or a secret store. Never commit it, paste it in an issue, or put it in a screenshot or log.
- Send it only in the `Authorization` header over HTTPS. Never put it in a URL, where it ends up in logs and browser history.
- Keep it on your server. Browser JavaScript and mobile apps would expose it, and the API does not send CORS headers anyway.
- An agent should never print the key in its answer.