# Authentication

API keys for the REST API and MCP server.

Every REST and MCP request uses the same header. Missing or invalid keys return `401`.

`Authorization: Bearer sk-ndl-…`

## Create a key

1. Open [API keys](/api-keys) in the dashboard.
2. Create a key. It looks like `sk-ndl-…`.
3. Copy it once. The full key is only shown then.

## Scope

Each key is bound to one user and one organization. The dashboard, API, and MCP all work in the organization the key is bound to.

- **User**: The key acts as the user who created it.
- **Organization**: Requests run in the organization the key is bound to.

## REST API

Send the header on every request to `/api/v1`. See the [API Reference](/docs/api-reference/introduction).

```bash
curl undefined/api/v1/me \
  -H "Authorization: Bearer sk-ndl-…" \
  -H "Content-Type: application/json"
```

## MCP

Call tools with the same key. Listing tools at `/mcp/v1/tools` does not require a key. See the [MCP catalog](/docs/mcp/introduction).

```json
{
  "mcpServers": {
    "needle": {
      "url": "undefined/mcp/v1",
      "headers": {
        "Authorization": "Bearer sk-ndl-…"
      }
    }
  }
}
```