---
title: Authentication
description: API keys for the REST API and CLI, and OAuth for the hosted MCP server.
sidebar:
  icon: key-round
---

BrainyShorts has two ways to authenticate, one per surface.

| Surface | Credential | How to send it |
| --- | --- | --- |
| REST API, CLI, runners | API key (`ba_sk_...`) | `Authorization: Bearer <key>` |
| Hosted MCP server | OAuth access token | Your MCP client handles it |

## API keys

1. **Sign in**

    Create a free account at [brainyshorts.com](https://www.brainyshorts.com/signup) and connect at least one social account.

2. **Create a key**

    Open [Dashboard → API keys](https://www.brainyshorts.com/dashboard/api-keys) and create a key. The full key is shown once and never again, so store it in your secret manager right away.

3. **Send it as a Bearer token**

    ```bash
    curl https://www.brainyshorts.com/api/cli/accounts \
      -H "Authorization: Bearer $BRAINY_API_KEY"
    ```

Keys:

- start with `ba_sk_`, and only a hash is stored
- expire 365 days after creation
- carry the scopes `cli:access`, `media:write`, and `automation:runs:claim`
- can be revoked from the same dashboard page

:::warning
Send the key in the `Authorization` header. The `x-api-key` header is not accepted, and keys are never read from query strings.
:::

## OAuth for MCP

The hosted MCP server at `https://www.brainyshorts.com/api/mcp` uses OAuth 2.1 with PKCE and dynamic client registration. You don't create anything by hand: add the server URL to your client, and it discovers the flow from:

- `https://www.brainyshorts.com/.well-known/oauth-protected-resource/api/mcp`
- `https://www.brainyshorts.com/.well-known/oauth-authorization-server`

The client opens a browser window, you sign in and approve, and the client stores the token. Scopes are `brainy:read` and `brainy:write`. See [MCP server](/mcp) for per-client setup.