# Authentication

Keep API keys server side

> Section: Guides

> Last updated: **2026-09-04**.

> API version: **v1 (Latest)**. OpenAPI publication: **2026-11-08**.

## Choose an authentication path

The correct path depends on where the credential would be stored.

| Client | Authentication | Start here |
| --- | --- | --- |
| Retail AI chat | OAuth browser sign in | [Agent setup](https://beliefstate.ai/docs/mcp-server) |
| Trusted server or local agent | Bearer API key | [Device authorization](https://beliefstate.ai/auth.md) |

## REST API keys

Send the revocable secret in the Authorization header on every protected request.

```text
Authorization: Bearer $BELIEFSTATE_API_KEY
```

Keep the key server side. BeliefState stores only its hash and cannot show the full value again.

## MCP OAuth

The client discovers BeliefState's authorization metadata and opens browser sign in and consent.

Each client gets its own user owned, revocable grant. Never paste an API key into a retail AI chat.

- [Connect a supported AI client](https://beliefstate.ai/connect)

## Recovery

Revoke a suspected leaked key immediately, then create a replacement through the same approved flow.

Create a replacement through the same approved flow. Never reuse a leaked key.

- [Manage API keys](https://beliefstate.ai/account#api-keys)
- [Manage AI connections](https://beliefstate.ai/account/connections)

## Agent feedback

Report unclear, stale, or incorrect documentation through [BeliefState support](https://beliefstate.ai/contact). Include this page URL and the smallest reproducible detail.

<!-- BeliefState-Origin: https://beliefstate.ai/docs/guides/authentication; Content-Fingerprint: bs-sha256-cf6fd2a406a3d1ca41099c9041a5bb56a71e483180164aa9e014e6f44e08782f -->