# Authentication

> Every request sends your API key in one header.

Source: https://developers.mnml.ai/docs/authentication

**Header**

```
Authorization: Bearer mk_live_…
```

Keys start with `mk_live_` and belong to your mnml.ai account. A missing, wrong or revoked key answers `401 UNAUTHENTICATED`.

## Get a key

### Step 1: Open API keys

In the [console](https://developers.mnml.ai/console/keys), choose **Create key**.

### Step 2: Name it after where it runs

One key per app or environment, such as “Production server”, so you can revoke one without breaking the others.

### Step 3: Copy it into your server’s settings

The key is shown once. Keep it in an environment variable or a secret store, never in your code.

## Keep your key safe

> [!WARNING]
> Call the API from your server, not from a browser or a mobile app, where anyone can read the key and spend your balance.

- Set a daily spend limit on each key in the console, so a leak or a bug has a ceiling.
- Revoke a key the moment you think it has leaked, then make a new one.
- Need to call from a browser on purpose? Add your site under the key’s allowed origins.

## Request ids

Every answer carries an `X-Request-Id` header, and every error repeats it in its body as `error.request_id`. Send it when you [contact support](https://developers.mnml.ai/contact) and we can find the exact request.