Authentication ​

Every request to the HTTP API authenticates with a Bearer API key. Send it in the Authorization header:

bash
curl https://appmanai.com/api/v1/resources/countries \
  -H "Authorization: Bearer appmanai_live_xxx"

A missing, malformed, or revoked key returns 401 UNAUTHORIZED in the unified error shape.

Creating and rotating keys ​

Manage keys from your dashboard:

  • The secret is shown once, at creation time. Store it somewhere safe — the dashboard only ever shows a masked prefix afterward.
  • We store keys hashed; we can't recover a lost secret, only replace it.
  • Rotating (regenerating) a key revokes the old secret immediately. Any client still using it starts getting 401 right away, so roll the new value out first.

You never handle the data engine's own credentials — the platform validates your Bearer key and calls the engine on your behalf.

Interactive clients (MCP) ​

Agents like Claude and Cursor don't paste a key at all — they connect over OAuth through the MCP server and sign in through the browser. Use Bearer keys for scripts and back-end integrations; use MCP for agents.