> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agent-drop.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication: API Keys, Bearer Tokens, and Scopes

> How AgentDrop API keys (agd_) work: Bearer-token authentication, dashboard creation, scoped agent credentials, rotation, and revocation security best practices.

<Note>
  **Audience: human account holder.** API key creation, rotation, and revocation are performed in the AgentDrop dashboard by the account holder.
</Note>

All API requests require a Bearer token in the `Authorization` header. API keys start with `agd_`.

## Creating an API Key

API keys are created manually from the dashboard. There is no API endpoint that auto-generates keys on account creation.

1. Sign up at [agent-drop.com](https://agent-drop.com) using email, Google, or GitHub
2. Go to [Dashboard → API Keys](https://agent-drop.com/dashboard/api-keys)
3. Click **Create New Key** and give it a descriptive name
4. Copy the key (`agd_...`), you can reveal it again later from the dashboard if you lose it

## Using Your API Key

Include your key in every request:

```bash theme={null}
curl -X GET https://api.agent-drop.com/v1/transfers \
  -H "Authorization: Bearer agd_live_xxxxxxxxxxxxxxxxxxxx"
```

Requests without a valid key return `401 Unauthorized`.

## Creating Additional API Keys

Generate more keys for different agents, environments, or team members from [Dashboard → API Keys](https://agent-drop.com/dashboard/api-keys). You can also use the API:

```bash theme={null}
curl -X POST https://api.agent-drop.com/v1/accounts/acc_abc123/api-keys \
  -H "Authorization: Bearer agd_live_xxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"name": "staging-agent"}'
```

```json theme={null}
{
  "id": "key_xyz789",
  "name": "staging-agent",
  "api_key": "agd_live_yyyyyyyyyyyyyyyyyyyy"
}
```

The number of API keys you can create depends on your plan:

| Plan       | API Keys  |
| ---------- | --------- |
| Free       | 2         |
| Builder    | 10        |
| Team       | 50        |
| Scale      | Unlimited |
| Enterprise | Unlimited |

## Revoking API Keys

Revoke a compromised or unused key immediately:

```bash theme={null}
curl -X DELETE https://api.agent-drop.com/v1/accounts/acc_abc123/api-keys/key_xyz789 \
  -H "Authorization: Bearer agd_live_xxxxxxxxxxxxxxxxxxxx"
```

Revoked keys return `401` on all subsequent requests. This is instant and irreversible.

## Security Best Practices

<AccordionGroup>
  <Accordion title="Use environment variables">
    Never hardcode API keys in source code. Store them in environment variables or a secrets manager.

    ```bash theme={null}
    export AGENTDROP_API_KEY="agd_live_xxxxxxxxxxxxxxxxxxxx"
    ```

    ```python theme={null}
    import os
    api_key = os.environ["AGENTDROP_API_KEY"]
    ```
  </Accordion>

  <Accordion title="Use separate keys per environment">
    Create distinct keys for development, staging, and production. If a staging key leaks, your production traffic is unaffected.
  </Accordion>

  <Accordion title="Rotate keys regularly">
    Create a new key, update your agents, then revoke the old key. Zero-downtime rotation.
  </Accordion>

  <Accordion title="Monitor for unauthorized usage">
    Check your transfer list regularly. Unexpected transfers from unknown senders may indicate a leaked key.
  </Accordion>

  <Accordion title="Never expose keys in client-side code">
    AgentDrop keys are server-side only. Never include them in browser JavaScript, mobile apps, or public repositories.
  </Accordion>
</AccordionGroup>

## Error Responses

| Status                  | Meaning                                                |
| ----------------------- | ------------------------------------------------------ |
| `401 Unauthorized`      | Missing or invalid API key                             |
| `403 Forbidden`         | Valid key but insufficient permissions for this action |
| `429 Too Many Requests` | Rate limit exceeded. Back off and retry.               |