Authentication

Every request authenticates with an API key in the Authorization header. Keys use the m8_ prefix.

curl "https://api.m8tes.ai/api/v2/agents?user_id=customer_123" \
  -H "Authorization: Bearer m8_your_key_here"

from m8tes import M8tes

client = M8tes(api_key="m8_your_key_here")
# or set M8TES_API_KEY and call M8tes() with no args

Get a key

In code: m8tes.signup(...) creates an account and returns a key in one call, no dashboard visit. See the Quick Start.
Dashboard: grab or rotate your key at the Developer dashboard.
Agent-created accounts: passwordless signup returns a setup-only key that is revoked when the owner activates the account, so an onboarding agent never keeps lasting access. See Use Your Coding Agent.

Environment conventions

Variable	Purpose
`M8TES_API_KEY`	Secret key used by `M8tes()` and the CLI
`M8TES_BASE_URL`	Optional custom API URL; include `/api/v2`

Rotation and named keys

Rotate the default key with client.keys.rotate() (or POST /api/v2/token). Rotation invalidates the previous key immediately, so update your stored secret in the same motion.

For anything beyond a single environment, use named keys: independently revocable, optionally expiring.

Python

key = client.keys.create(name="staging", expires_in_days=90)
print(key.api_key)  # full key returned ONCE. Store it now

client.keys.list()            # named keys, secrets never returned
client.keys.rotate(key.id)    # rotate one key without touching the others
client.keys.revoke(key.id)    # stops authenticating immediately

One named key per environment means a leaked staging key is revoked on its own, with production untouched.

Sessions vs. keys

The web dashboard signs its own requests with browser session tokens; integrations use m8_ keys, server-side only. Never ship a key in client-side code. For user-facing UIs, route agent calls through your own backend (the React embed does exactly this with a server handler).

Multi-tenancy is not per-key

Don't mint a key per customer. One account key plus user_id on each run scopes memory, history, and tool connections to that end-user automatically. See Multi-tenancy.

Before production: the API key hygiene checklist.