> ## Documentation Index
> Fetch the complete documentation index at: https://docs.madiad.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Generate an API key and authorize every request to MADIAD Hub.

MADIAD Hub uses **API keys** to authenticate requests. Every call must include your key in the `Authorization` header as a Bearer token.

```bash theme={null}
Authorization: Bearer mdc_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

Requests without a valid key return `401 Unauthorized`.

## Create a key

1. Sign in to [hub.madiad.com](https://hub.madiad.com).
2. Open **API Keys** and click **Create key**.
3. Name it (e.g. `production`, `n8n`, `staging`) and copy the value.

<Warning>
  A key is shown **only once**, at creation. Copy it immediately and store it in a secret manager. If you lose it, revoke the key and create a new one.
</Warning>

## Key format

| Part   | Example     | Meaning                                                              |
| ------ | ----------- | -------------------------------------------------------------------- |
| Prefix | `mdc_live_` | Environment — `live` keys publish real posts                         |
| Body   | `a1b2c3…`   | The secret. Only the prefix is shown in the dashboard after creation |

The dashboard lists each key by its prefix and name, so you can identify a key without exposing the secret.

## Use the key

Send it as a Bearer token on every request:

```bash theme={null}
curl https://api.madiad.com/v1/connections/status \
  -H "Authorization: Bearer $MADIAD_API_KEY"
```

Store the key in an environment variable — never hard-code it in source or ship it in client-side code:

```bash theme={null}
export MADIAD_API_KEY="mdc_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
```

## Rotate and revoke

Treat keys like passwords:

* **Rotate** periodically — create a new key, update your apps, then revoke the old one.
* **Revoke** immediately if a key is exposed. Revocation takes effect within seconds and cannot be undone.
* Use a **separate key per integration** (one per app, server, or workflow) so revoking one never breaks the others.

<Note>
  Need to authorize a *social account* rather than an API request? That happens per **profile** — see [Profiles](/concepts/profiles).
</Note>