# Authentication

API keys for your code, OAuth for AI agents.

## API keys [#api-keys]

Send your key as a bearer token on every request.

```bash
curl https://api.rizamo.com/v1/profiles \
  -H "Authorization: Bearer $RIZAMO_API_KEY"
```

- Create keys in the web app, under **Developers**. A key starts with `rz_live_` and is shown once.
- A key belongs to the team, not to a person, so it keeps working when someone leaves.
- A key can be limited to some profiles and to some permissions.
- Rotating a key keeps the old one working for 24 hours.

Never put a key in a URL, a public repository or client-side code.

## AI agents [#ai-agents]

The MCP server signs in with OAuth: your agent opens a Rizamo sign-in page and you choose what it can reach. No key to copy.