> ## Documentation Index
> Fetch the complete documentation index at: https://docs.moneyline.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, personal access tokens, and how the environment is chosen for you.

Every request to the API must be authenticated. There is no anonymous access beyond the health endpoints.

## API keys

Organization API keys are the normal way to call Moneyline from a server. The prefix tells you — and the API — which environment the key belongs to.

| Prefix | Environment | Used for |
| - | - | - |
| `ml_live_` | live | Production traffic, real data |
| `ml_test_` | test | Sandbox traffic, safe to seed and wipe |

> [!WARNING]
>
> The environment is derived from the key prefix, not from the URL or a header.
> A `ml_test_` key sent to production reads and writes sandbox data.

Send the key one of two ways. Both are accepted on every endpoint:

```bash Authorization header theme={null}
curl http://localhost:3000/v1/submissions \
  -H "Authorization: Bearer $MONEYLINE_API_KEY"
```

```bash X-Api-Key header theme={null}
curl http://localhost:3000/v1/submissions \
  -H "X-Api-Key: $MONEYLINE_API_KEY"
```

All three SDKs read `MONEYLINE_API_KEY` from the environment, so the key rarely appears in code:

```ts TypeScript icon="https://mintcdn.com/paragon-f28ba471/UuDHN4B1J-v_DThS/images/lang/typescript.svg?fit=max&auto=format&n=UuDHN4B1J-v_DThS&q=85&s=cba1e12257cdbf42b6c7a23031def04f" theme={null}
import { Moneyline } from '@moneyline/sdk';

// Reads MONEYLINE_API_KEY and MONEYLINE_BASE_URL from the environment.
const client = new Moneyline();
```

```python Python icon="https://mintcdn.com/paragon-f28ba471/UuDHN4B1J-v_DThS/images/lang/python.svg?fit=max&auto=format&n=UuDHN4B1J-v_DThS&q=85&s=a9a026d5d8b16735c0cea1b7dd0ac6e5" theme={null}
from moneyline import Moneyline

client = Moneyline()
```

```go Go icon="https://mintcdn.com/paragon-f28ba471/UuDHN4B1J-v_DThS/images/lang/go.svg?fit=max&auto=format&n=UuDHN4B1J-v_DThS&q=85&s=338b141516fd81c7c6c2302fdf1e318b" theme={null}
client, err := moneyline.NewClient("")
if err != nil {
	log.Fatal(err)
}
ctx := context.Background()
```

To pass one explicitly:

```ts TypeScript icon="https://mintcdn.com/paragon-f28ba471/UuDHN4B1J-v_DThS/images/lang/typescript.svg?fit=max&auto=format&n=UuDHN4B1J-v_DThS&q=85&s=cba1e12257cdbf42b6c7a23031def04f" theme={null}
const client = new Moneyline({ apiKey: 'ml_live_xxxxx' });
```

```python Python icon="https://mintcdn.com/paragon-f28ba471/UuDHN4B1J-v_DThS/images/lang/python.svg?fit=max&auto=format&n=UuDHN4B1J-v_DThS&q=85&s=a9a026d5d8b16735c0cea1b7dd0ac6e5" theme={null}
client = Moneyline(api_key="ml_live_xxxxx")
```

```go Go icon="https://mintcdn.com/paragon-f28ba471/UuDHN4B1J-v_DThS/images/lang/go.svg?fit=max&auto=format&n=UuDHN4B1J-v_DThS&q=85&s=338b141516fd81c7c6c2302fdf1e318b" theme={null}
client, err := moneyline.NewClient("ml_live_xxxxx")
```

## Personal access tokens

Tokens prefixed `ml_pat_` authenticate as a **user** rather than an organization, and carry that user's permissions. They are intended for CLI use and local scripting, not for server-to-server traffic.

```bash theme={null}
curl http://localhost:3000/v1/submissions \
  -H "Authorization: Bearer ml_pat_xxxxx"
```

## Session cookies

The dashboard authenticates with a session cookie issued by Better-Auth. This path exists for the first-party dashboard only — it is not a supported integration surface, and it is not exercised by the SDKs.

## Rotating a key

Create the replacement first, deploy it, then revoke the old key. Revocation takes effect immediately and in-flight requests using the revoked key will fail.

```bash theme={null}
curl -X POST http://localhost:3000/v1/api-keys \
  -H "Authorization: Bearer $MONEYLINE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "backend-2026-09"}'
```

> [!NOTE]
>
> The plaintext key is returned **once**, at creation. Afterwards only its prefix
> and last four characters are readable.

## Storing keys

> [!WARNING]
>
> Never commit an API key, and never send one to the browser. A `ml_live_` key
> grants full read and write access to every submission in the organization.

Keep keys in your secret manager and expose them to the process as `MONEYLINE_API_KEY`. If a key leaks, revoke it — rotation is cheap, and there is no way to scope a leaked key retroactively.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.