# API keys

> Create your account and a key for your app, and use it to authenticate requests from your server.

Your API key identifies your app. Send it in the `Authorization` header of each request:

```http
Authorization: Bearer YOUR_API_KEY
```

## Getting a key

In the [dashboard](https://app.apigami.com), open your app, then **API keys** → **New API key**.
Give the key a name and copy it. It's shown only once.

Store it in your server's configuration. Keep it out of frontend code and your repository.
You don't need to send an app ID alongside it.

## Apps, teams and keys

An app is the service your users connect to. Its name appears when they approve access to a site.
Your team can have several apps, each with its own keys and approvals. A user's `user_ref` is the
same for every app of your team; it only works with your team's keys.

Your [AI assistant](/docs/mcp/) doesn't use your team's apps: it acts through a private app of your
own account, which only reaches your own browsers.

## Replacing a key

Create a new key, update your server to use it, then revoke the old one in the dashboard.
Revoked keys stop working immediately.

Keys don't expire and belong to the app. A key keeps working if the teammate who created it leaves.

## Account access

### Your account

[Sign up](https://app.apigami.com/register) with your email: the account is ready at once, with
your own team. There's no password. You sign in with a 6-digit code sent by email, valid for one
hour, or with a link in the same email. You stay signed in for 30 days after your last visit.

The users of your app have Apigami accounts too, created the same way when they first
[connect](/docs/connect/).

### Confirming your email

Creating your first app and using the [MCP server](/docs/mcp/) require a confirmed email address.
The dashboard asks you to confirm it and sends the confirmation email. Signing in with a code
confirms it too.

To add a teammate, invite them by email from **Team**. The invitation email carries a link that
works for their address only, for 14 days; accepting it confirms their address.

If no member of the app's team has an active account, API requests return `403 client disabled`.
A disabled account cannot sign in.

### Connected users

A user must [connect their account](/docs/connect/) to your app before you can call it.
Knowing a `user_ref` alone doesn't give access.

Private apps are for team members. Unlisted apps let anyone with the link connect.

### Verification

An unverified app can connect up to ten users. [Contact us](mailto:contact@apigami.com)
when you're ready to connect more. Your dashboard shows **Verified** after the review.

<details>
<summary>Verification limits and compatibility</summary>

The eleventh user sees `client not verified` on the connect page; the ten existing connections
keep working. A team without a verified app can publish up to three apps beyond private ones.
The approval window identifies apps that haven't been verified yet.

Older integrations may send `appId` or `clientId` in the request body. If present, it must match
the key's app, or the request returns `400 clientId does not match the token`.
The word `client` is kept in error strings for compatibility.

</details>

For a missing or revoked key, the API returns `401 bad client credentials`.
See [Troubleshooting](/docs/errors/) for help with other responses.