> ## Documentation Index
> Fetch the complete documentation index at: https://docs.droyd.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API-Key Authentication

> Authenticate an automation as one Droyd account.

Create and rotate Droyd API keys in the web app, then store each secret in your
automation's secret manager. A key acts for its owner, so every workflow,
experiment, artifact, evaluation, submission, and usage record is
automatically scoped to that account.

```bash theme={null}
curl /v1/auth/me \
  -H "Authorization: Bearer $DROYD_API_KEY"
```

You can instead send `x-droyd-api-key`. Do not send both forms in the same
request. API keys are for unattended services and CI; use the CLI's browser
sign-in flow for a person working on a local workspace.

Accepted forms are `Authorization: Bearer <Droyd API key>` and
`x-droyd-api-key: <Droyd API key>`. When `Authorization` is present it wins;
an invalid, non-Bearer, revoked, or malformed Authorization value is rejected
instead of falling back to `x-droyd-api-key`. Common failures are
`missing_authorization`, `invalid_authorization`, invalid/revoked-key errors,
and active-account or entitlement failures. Never log, persist in a workflow
file, return in an error, or place a key in a URL.