> ## Documentation Index
> Fetch the complete documentation index at: https://www.openpmm.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate API requests with an account-owned OpenPMM API credential.

An API credential belongs to one account. It can have access to all workspaces or selected workspaces. The dashboard creates a selected-access credential from **Workspace settings** → **API keys**.

OpenPMM shows the API key secret one time. Send the secret as a bearer token.

`POST /signup-intents`, `POST /cli-authorizations`, and
`POST /cli-authorizations/token` do not need an API key. They form the
short-lived browser handoff that creates a credential before one exists.

```bash theme={null}
curl --request GET \
  --url https://api.openpmm.com/v1/me \
  --header "Authorization: Bearer $OPENPMM_API_KEY"
```

The header format is:

```http theme={null}
Authorization: Bearer <api-key>
```

## Key handling

* Store keys in a server-side secret manager.
* Never expose a key in browser code, mobile binaries, logs, or URLs.
* Use separate keys for separate deployments or integrations.
* Revoke a key when you do not need it.
* Revoke and replace a key when another person or system can have access to it.

<Warning>
  Do not extract a key from the OpenPMM CLI credential store. A direct API
  integration must use its own least-privilege credential. Let the CLI manage
  the credential that it creates.
</Warning>

Call `GET /account` to get the account and credential context. Call `GET /workspaces` to list the workspaces that the credential can use.