# Authentication

ZRouter has three credentials. Each does one job.

| Credential | Used for | Created in | Header |
| --- | --- | --- | --- |
| Account API key | Model requests on `/v1/*` | Dashboard **API keys**, `zctl`, or MCP `api_keys_create` | `Authorization: Bearer <key>` (Anthropic SDKs may send `x-api-key`) |
| MCP token, or MCP OAuth sign-in | Account management through `https://zrouter.si/mcp` | Dashboard **CLI and MCP access** | `Authorization: Bearer <token>` |
| Provider key (BYOK) | Paying a provider directly | Dashboard **Bring your own keys** | Never sent by the client. Add `X-ZRouter-BYOK: true` to use it |

Rules for agents:

- An account API key cannot manage the account, open the dashboard, or act as an operator. An MCP token cannot send model requests.
- MCP tokens expire after 30 days. MCP clients that support OAuth need only the server URL.
- Agents cannot create accounts or buy credit. Both need a person.
- Never print, log, or commit any of these secrets. A key created through MCP appears in the tool result, so treat the conversation history as sensitive.

Next: [API reference](/docs/api.md)