> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bead.run/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Configure sandbox API authentication with private keys or delegated bearer access and choose the scopes your requests need.

Use sandbox API authentication with a private bead key in the `X-API-Key` header for direct API requests. The SDKs read `BEAD_API_KEY` by default.

## API keys

```bash theme={null}
curl -sS https://api.bead.run/v1/limits   -H "X-API-Key: $BEAD_API_KEY"
```

Load the key through a private environment or secret manager. Keep it out of URLs, source files and request logs. See [agent signup](https://docs.bead.run/agent-signup.md) for enrollment and [CLI accounts](https://docs.bead.run/cli/accounts.md) for CI preset key creation.

## Delegated bearer access

The API also accepts supported delegated OAuth credentials in `Authorization: Bearer`. Tokens are audience-bound. API device authorization through `bead login` targets the API audience; MCP OAuth targets the canonical MCP resource. Use the token issued for the service you are calling.

Delegation retains the original credential identity. Organization restrictions, scope, revocation and prepaid budget checks still apply. Follow the client's authorization flow and reconnect when credentials expire.

A scoped bead key can be used as bearer authentication on [MCP](https://docs.bead.run/mcp/connect.md). For direct API-key requests, use `X-API-Key`.

## Scope and resource access

The server enforces read, use, write and admin authority according to the route. Reads generally require read access; execution and existing-machine mutations require use authority; creation requires write authority. Account administration, billing settings and other administrative controls require admin authority.

A CI preset key has additional resource restrictions: it can create machines and access or delete its own machines, but cannot access other machines, credential profiles or billing administration. A valid key does not bypass funding or admission checks.

## Public prices

Pricing and estimates do not require credentials:

```bash theme={null}
curl -sS https://api.bead.run/v1/pricing
curl -sS https://api.bead.run/v1/pricing/estimate   -H 'Content-Type: application/json'   --data '{"vcpus":1,"memory_mib":2048,"disk_mib":1024,"duration_seconds":60}'
```

`GET /v1/pricing` is the live price source. Read [workload estimates](https://docs.bead.run/platform/estimates.md) before provisioning.

An authentication failure returns `401`; insufficient authority returns `403`. Inspect the response before retrying or changing credentials.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.