# Authentication & API keys

URL: https://docs.testvibe.com/testvibe-api/getting-started/authentication

Every surface — REST, CLI, MCP — authenticates with a long-lived **API key** .

## Creating a key

Keys are created in the TestVibe app under **Settings → CLI & API keys** . A key looks like:

```text
tvb_9hK2mPqRsT4uVwXyZ1aB3cD5eF7gH8jL0nQ6rS2tU4v
```

- The `tvb_` prefix plus 43 base62 characters.
- The full key is shown **exactly once** , at creation. Only a hash is stored server-side; if you lose the key, revoke it and create a new one.
- The Settings panel shows each key's display prefix ( `tvb_XXXXXXXX` ), creation date, and last-used time.

## Using a key

Send it as a bearer token on every request:

```bash
curl -H "Authorization: Bearer $TESTVIBE_API_KEY" \
  "$TESTVIBE_SERVER/api/v1/ops/projects"
```

The CLI and MCP server read it from `testvibe login` , the `TESTVIBE_API_KEY` environment variable, or per-repo config — see [The testvibe CLI](/testvibe-api/cli) .

## What a key can do

A key **acts as the user who created it, inside the workspace it was created in** :

- It can see and operate on every project of that workspace (subject to the creator's access).
- It stops working immediately if it is **revoked** , or if the creating user **leaves the workspace** .

## Failure mode

Requests without a valid key get `401` :

```json
{
  "error": "unauthorized",
  "message": "A valid API key is required (Authorization: Bearer tvb_…)."
}
```

warning
**Key hygiene.** Put keys in environment variables or secret stores, never in committed files. Create one key per machine or integration so you can revoke them independently.