> ## Documentation Index
> Fetch the complete documentation index at: https://docs.datalayer.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Use account-scoped API keys for REST or browser authorization for MCP.

## REST API keys

Approved users can create and revoke keys in the
[Datalayer dashboard](https://app.datalayer.so). Send the key in every API request:

```http theme={null}
Authorization: Bearer YOUR_DATALAYER_API_KEY
```

Production keys begin with `dl_live_`; staging keys begin with `dl_test_`. Use a key
only with its matching environment. A production key does not activate billing or
create an allowance. Your account is determined by the credential; do not send an
account ID to select another account.

Use `GET https://api.datalayer.so/v1/auth` to check a key without consuming profiles.
A valid key returns `{"authenticated":true}`. Missing, invalid or revoked keys
return HTTP `401`.

Store keys in a secret manager or private environment variables. Do not put them in
URLs, screenshots, support messages, public repositories or browser-side code.
Revoke an exposed key in the dashboard.

## MCP authorization

Compatible MCP clients can use browser-based OAuth sign-in. Authorize the Datalayer
connection using the same account as your dashboard. Alternatively, a client with
private Bearer-header support can use a Datalayer API key.

Dashboard session cookies are not REST API credentials. Follow the
[MCP setup guide](/connect-your-assistant) for the hosted endpoint and current connection limitations.

## Access during private preview

Public signup is restricted. An installation link or API key does not by itself
provide data access. Searches and lookups need an active allowance, even if
authentication and tool discovery succeed.