> ## Documentation Index
> Fetch the complete documentation index at: https://cue.vibeset.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate, and how to keep your keys safe.

Every request carries your API key. Cue accepts it either way, so use whichever your client
reaches for:

```bash theme={null}
Authorization: Bearer vbsk_live_...
```

```bash theme={null}
x-api-key: vbsk_live_...
```

Create and manage keys in the [developer portal](https://cue.vibeset.ai/developer).
A key is shown to you **once**, at the moment you create it. Copy it then. We store
only a hash, so if you lose it, rotate or revoke it.

<Note>
  The same key authenticates the [MCP server](/docs/mcp-server). Set it as a Bearer token in your
  agent's config (no OAuth, no separate credential). That's the header the MCP authorization
  spec uses, so most clients ask for it by default.
</Note>

## Keys and billing

Keys carry their mode in the prefix, so you always know which one you're holding. Customer keys
are always `vbsk_live_`. Test keys are an internal Vibeset tool, and the portal refuses to issue
one to a customer account.

| Prefix       | Mode | Billed? | Use it for                                |
| ------------ | ---- | ------- | ----------------------------------------- |
| `vbsk_live_` | Live | Yes     | Everything: building, CI, and production. |

A key needs either a card on file or a live credit grant. Each call runs real analysis against the
licensed catalog, so it costs money to serve and is metered accordingly (see
[Metering & pricing](/docs/metering-and-pricing)). If we sent you a credit code, redeeming it stands in
for the card while the grant lasts, and your account can hold two live keys until you add
one. See
[Starting credits](/docs/credits). Set a monthly spend cap in the portal if you want a hard ceiling
while you build.

Each key gets its own rate limit, 60 requests per minute by default. More keys means more
concurrency, which is why a credit-funded account is capped at two of them.

## Keep keys server-side

API keys are secrets. Call Cue from your backend, never from browser or mobile code
where a key would be exposed.

If a key leaks, revoke it in the portal. The instance that serves the revoke stops honouring the
key at once, and other warm instances converge within the 30-second key-validation cache. Treat
30 seconds as the worst case, not the typical one.

<Tip>
  Rotating a key issues a replacement immediately and schedules the old one to expire 24 hours
  later, so you can cut over without downtime. Rotation is not billing-gated, so a leaked key can be
  rolled even if billing has lapsed.
</Tip>