> ## Documentation Index
> Fetch the complete documentation index at: https://help.mentionpilot.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate with the MentionPilot API

All API requests must be authenticated using an API key passed as a Bearer token in the `Authorization` header.

```bash theme={null}
Authorization: Bearer YOUR_API_KEY
```

***

## Generate an API key

Go to your API Keys page to create a key:

<Card title="API Keys" icon="key" href="https://app.mentionpilot.ai/api-keys">
  Generate and manage your API keys
</Card>

1. Click **Create new key**
2. Give it a name so you can identify it later
3. Choose the key type — **Global** or **Brand-scoped**
4. Copy the key immediately — it won't be shown again

***

## Key types

<CardGroup cols={2}>
  <Card title="Global key" icon="globe">
    Access all brands and data in your account.

    Use this for server-side integrations where you need full access.
  </Card>

  <Card title="Brand-scoped key" icon="building">
    Restricted to a single brand.

    Use this when you want to limit access — for example, sharing data with a specific client or team.
  </Card>
</CardGroup>

***

## Example request

```bash theme={null}
curl -X POST https://app.mentionpilot.ai/api/v1/brand-report \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "brand_id": 1 }'
```

***

## Security guidelines

* Never expose your API key in client-side code or public repositories
* Rotate keys regularly and revoke any that are no longer in use
* Use brand-scoped keys wherever full account access is not needed
* If a key is compromised, delete it immediately from the [API Keys page](https://app.mentionpilot.ai/api-keys) and generate a new one

***

## Error responses

| Status | Meaning                                                                           |
| ------ | --------------------------------------------------------------------------------- |
| `401`  | Missing or invalid API key                                                        |
| `403`  | Key does not have access to the requested resource (brand-scoped key restriction) |