> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aicmelabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Every request carries your lab's key.

Send your key as a bearer token on every request, in the `Authorization` header:

```bash theme={null}
curl https://api.aicmelabs.com/v1/rewards/REWARD_ID \
  -H "Authorization: Bearer your-api-key"
```

A request without a valid key gets `401 unauthenticated`.

> [!TIP]
>
> On a shared host, keep the key out of the command line, where other users can see it in the process list: put the
> header in a file only you can read, and pass it with `curl -H @header.txt`.

## Keys

* **A key belongs to one lab.** Your lab can hold several, for example one per cluster or per person, and each can be
  revoked on its own.
* **AICME issues keys.** Ask us for a new one, or to revoke one. A revoked key gets `401` from then on.
* **We show a key once,** when we hand it over, and we keep only a hash of it. Store it in your secret manager. Don't
  put it in git, in a Docker image, or in a log.
* **The package's verifier reads the key from its environment** (`AICME_API_KEY`). It is never written into a
  package.

## What a key can see

Your key sees your lab's own resources, and nothing else:

* **Tasks your lab is granted.** A task that isn't granted returns `404`, the same response as a task that doesn't
  exist. A `404` never tells you whether a task exists.
* **Rewards your lab created.** Another lab's reward returns `404`.

Your lab comes from the key, never from the request: nothing you send can act as another lab.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.