# Authentication

Every `/v1` and `/mcp` request needs an API key. Send it in any of these headers:

| Header | Example |
| `x-api-key` | `x-api-key: apz_xxx` (recommended) |
| `Authorization` | `Authorization: Bearer apz_xxx` |
| `api-key` | `api-key: apz_xxx` |

## Managing keys
Create, rename, disable and delete keys in [Dashboard → API keys](/dashboard/keys). The full key is shown only once; we store a SHA-256 hash.

## IP allowlist
On Pro and above, restrict a key to specific client IPs. Requests from other IPs get `403`.

## Keep keys server-side
Never ship a key in a browser or mobile app. Call Apizie from your backend and forward the result.