---
title: Authentication
description: Authenticate with the dedicated Bearer API key safely.
sidebar:
  order: 3
---

Every request must include the dedicated key in the `Authorization` header:

```http
Authorization: Bearer YOUR_API_KEY
```

Query-string keys are not accepted. A dashboard session Cookie cannot replace this key, and this key cannot access existing `/bi/*` routes.

## Key handling

- Keep the key in a secret manager or protected environment variable.
- Never commit it to source control, logs, screenshots, or support messages.
- Do not enable **Remember on this device** in the Playground on a shared computer. That option stores the key in this documentation origin's `localStorage` until it is cleared.
- Ask your Mellow contact to rotate the key if it may have been exposed.

:::warning
The v1 integration uses one shared key. Rotating it invalidates the previous key for every caller using this endpoint.
:::