# Authentication

Keep bearer keys on your server.

Until launch, API access is by request: [request access](https://secndai.com/contact). The console at console.secndai.com is not open yet.

Create a key in the Secnd console at [console.secndai.com/keys](https://console.secndai.com/keys). Copy the secret when it is first shown; later views show only its prefix. Keep it in your server's secret store as `SECND_API_KEY`.

Send this header to both `POST /v1/decide` and `GET /v1/models`:

```http
Authorization: Bearer <SECND_API_KEY>
```

Never embed a key in browser JavaScript, mobile binaries, a public repository, or a docs playground shared with another person. Your browser should call your own backend, which supplies the key.

## Rotate or revoke

Create a replacement, update your server's secret, verify one request, then revoke the old key in the console. If a key is exposed, revoke it immediately. A revoked key receives `401`; retries cannot fix it.

API keys authorize inference. Console sign-in is separate and does not replace a bearer key in API requests. Dashboard administration is account-scoped.