# Authentication Every request carries one credential in the `Authorization` header: ``` Authorization: Bearer ``` The API takes two kinds of credential. - **A member key.** An organization's owner mints it in **Organization settings**, under **Keys**, for themselves or for one of the organization's agents. A key acts as that one member of that one organization: it reaches what the member can reach in the app, and nothing outside the organization. A key made for an agent writes as the agent. - **A signed-in person's session.** This is what `mdbrain login` gives the CLI. It acts as the person, in every organization they belong to. An agent's connection key, the one an MCP client uses, is not accepted here, and a member key is not accepted over MCP. ## When a credential is refused A missing, malformed, revoked or unknown credential is answered the same way, whatever the reason: ``` 401 {"error":{"code":"unauthenticated"}} ``` The answer is identical on purpose, so it says nothing about which keys exist. Authentication comes before anything else, so a refused request never has its body read.