# Authentication

Rankings are public. Everything under `/v1/reports` needs an API key.

## Send the key as a Bearer token

```http
Authorization: Bearer rmk_…
```

```bash
curl https://api.recomention.com/v1/reports -H "Authorization: Bearer $RECOMENTION_API_KEY"
```

A missing, malformed, unknown or revoked key gets `401` with a `WWW-Authenticate: Bearer` header and an [error body](/errors/).

## Keys are shown once

Create keys at [recomention.com/account](https://www.recomention.com/account) → **Developers**.

- **Shown once.** When you create a key it is displayed one time. Only a fingerprint of it is stored, so nobody can show it to you again. Lost one? Revoke it and create another.
- **Recognisable.** Every key starts with `rmk_`, so a leaked key is easy to spot in a log or a secret scanner. The account page shows the first few characters of each key so you can tell them apart.
- **Up to 10 active keys** per account.
- **Revocable.** A revoked key stops working within about a minute. The key stays listed, marked revoked.

## A key reads only its own account

A report belonging to another account answers `404`, exactly like a report that does not exist. You cannot tell the two apart, by design.

## Starting reports needs a verified email

The report link is emailed to the account's address, so a start from an account whose email is not confirmed gets `403`. Sign in once with the email link or a verified Google/Apple account.

## Keeping keys safe

- **One key per agent or machine**, so you can revoke one without breaking the others. Each key also has its own [rate limit](/rate-limits/).
- Keep keys in environment variables or a secret manager, never in a repository.
- In an MCP client config, the key goes in the server's `env`; see [MCP server](/mcp/).
- If a key might have leaked, revoke it first and investigate after.