Authentication

Send your API key as a bearer token:

Authorization: Bearer mind_live_replace_me

Each key is scoped to one project. It can address only minds in that project, and the project is inferred from the key rather than supplied in message requests.

CLI login

The official CLI can save a project API key on a trusted developer workstation. pluralmatter login reads the key through a hidden prompt and writes it to an owner-only configuration file.

Use this for local exploration and evaluation, not as an authentication design for an application you distribute. See the CLI quickstart.

Keep keys server-side

Never embed a key in browser JavaScript, a mobile binary, a distributed desktop client, a model prompt, or an actor-controlled field. Route application calls through your authenticated backend.

Use a separate key for each environment or calling service. Store keys in a secret manager, rotate them when ownership changes, and revoke them immediately if they may have been disclosed.

An authentication failure uses the standard API error envelope and returns 401.