# Authentication & keys

Keep credentials on the server and replace them safely.

## Headers and storage

REST uses `X-API-Key`. MCP accepts `X-API-Key` or `Authorization: Bearer`. Keep `RADAR_API_KEY` in an environment or managed secret store. API keys never belong in public bundles, analytics, support messages, URLs or persisted browser storage.

## Create and replace

Keys are managed in the existing account. Give each integration a useful label. Copy the complete key at creation; later listings expose only its prefix. To rotate, create a replacement, update your server secret, verify one request, then revoke the old key. Revocation stops clients using that key; it does not create a replacement automatically.

## Failures

401 `missing_api_key`, `invalid_api_key` or `revoked_api_key` requires checking the configured header or replacing the key. 403 access errors require checking account status. Do not retry authentication failures in a loop.