Authentication

Every request authenticates with an API key in the Authorization header. Keys use the m8_ prefix.

Get a key

In code: m8tes.signup(...) creates an account and returns a key in one call, no dashboard visit. See the Quick Start.
Dashboard: grab or rotate your key at the Developer dashboard.
Agent-created accounts: passwordless signup returns a setup-only key that is revoked when the owner activates the account, so an onboarding agent never keeps lasting access. See Use Your Coding Agent.

Environment conventions

The SDK reads M8TES_API_KEY when constructed with no arguments; that's the convention every example in these docs (and the CLI) follows. M8TES_BASE_URL overrides the API base URL for self-hosted or local backends and must include the /api/v2 prefix.

Rotation and named keys

Rotate the default key with client.keys.rotate() (or POST /api/v2/token). Rotation invalidates the previous key immediately, so update your stored secret in the same motion.

For anything beyond a single environment, use named keys: independently revocable, optionally expiring.

Python

One named key per environment means a leaked staging key is revoked on its own, with production untouched.

Sessions vs. keys

The web dashboard signs its own requests with browser session tokens; integrations use m8_ keys, server-side only. Never ship a key in client-side code — for user-facing UIs, route agent calls through your own backend (the React embed does exactly this with a server handler).

Multi-tenancy is not per-key

Don't mint a key per customer. One account key plus user_id on each run scopes memory, history, and tool connections to that end-user automatically — see Multi-tenancy.

Before production: the API key hygiene checklist.