> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infragrid.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create, scope, rotate, and revoke workspace API keys safely.

The public API authenticates server requests with a workspace-scoped Infragrid API key.

```http theme={null}
Authorization: Bearer ig_live_...
```

Create and manage keys in [Developer settings](https://app.infragrid.ai/dashboard/developers). A key belongs to exactly one workspace; callers cannot select or switch workspaces in an API request.

<Warning>
  Never expose an `ig_live_` key in client-side JavaScript, a mobile binary, a URL, source control, telemetry, or support screenshots.
</Warning>

## Scopes

Grant the smallest set that supports the integration.

| Scope                   | Allows                                            |
| ----------------------- | ------------------------------------------------- |
| `runs:read`             | List and retrieve browser task or workflow runs   |
| `runs:write`            | Start and cancel browser task or workflow runs    |
| `blueprints:read`       | List and retrieve active published Blueprints     |
| `blueprints:run`        | Start a published Blueprint revision              |
| `blueprint_runs:read`   | List, retrieve, poll, and wait for Blueprint runs |
| `blueprint_runs:cancel` | Cancel Blueprint runs                             |

<Note>
  Key-management endpoints use an authenticated dashboard session, not a workspace API key. This prevents an API key from minting or escalating other credentials.
</Note>

## One-time reveal

The plaintext secret is returned only when a key is created or rotated. Infragrid stores a hash and safe metadata such as the prefix, scopes, timestamps, and status.

If you lose the value, rotate or replace the key. It cannot be recovered.

## Rotation

<Steps>
  <Step title="Create the replacement">
    Rotate the key in Developer settings and choose a grace period from zero to seven days.
  </Step>

  <Step title="Deploy the new secret">
    Update the secret manager and restart or redeploy every consumer.
  </Step>

  <Step title="Verify usage">
    Confirm calls succeed with the replacement and that the old key is no longer used.
  </Step>

  <Step title="End the overlap">
    Revoke the old key immediately, or let the bounded grace window expire.
  </Step>
</Steps>

## Environment variables

The SDKs and MCP adapter read:

```bash theme={null}
export INFRAGRID_API_KEY="ig_live_..."
```

Set `INFRAGRID_BASE_URL` only for an explicitly selected preview or self-hosted API. The CLI also accepts `INFRAGRID_API_URL` and gives it precedence for compatibility.

<Card title="Idempotent mutations" icon="rotate" href="/production/idempotency">
  Add a stable idempotency key before enabling automatic retries for run creation.
</Card>


## Related topics

- [API overview](/reference/overview.md)
- [Errors and retries](/production/errors-retries.md)
- [Infragrid overview](/overview.md)