Authentication
One Bearer key authenticates the REST API and the MCP server. How keys are stored, scoped, rotated and revoked.
One key, sent as a Bearer token. It works on every REST endpoint and on the MCP server — there is nothing else to configure.
Authorization: Bearer amnt_sk_1f4c9e...Key format
A key is amnt_sk_ followed by 64 hex characters. The prefix is
deliberate: it makes a leaked key recognisable to GitHub secret scanning, to
GitGuardian, and to you when you find one in a log.
amnt_sk_— the marker.skis "secret key"; treat it like a password.- The first 12 characters are shown in Settings so you can tell keys apart.
- Only a SHA-256 hash is stored. Nobody at amnt can read your key back to you — if you lose it, create a new one.
Creating and rotating
Keys live in Settings → API Keys. Up to five active keys per account.
- One key per environment. Production, staging, your laptop. When one leaks you revoke one thing, not everything.
- Rotating is two steps. Create the new key, deploy it, then revoke the
old one. Revoking takes effect immediately — any request still using it
gets a
401. - Revoked is permanent. A revoked key cannot be un-revoked.
Never ship a key to a browser
An amnt key spends real credits. Anything in front-end JavaScript, a mobile app bundle or a public repo is readable by anyone. Call the API from your own server and let your front end talk to that — there is a worked example.
What a key can do
Every key carries the agent:run scope: run agents, list agents, read your
own balance. A key cannot create other keys, cannot read or change your
account, cannot see another account's balance, and cannot read any agent's
recipe — prompt templates never leave the server on any rail.
Whose credits get spent
A key resolves to the account that made it, and that account's credit balance pays. It is the same balance the website shows: a run from your code and a run from the site come out of the same pot.
Auth failures
| Code | What it means | What to do |
|---|---|---|
401 | Missing or malformed Authorization header | Send exactly Authorization: Bearer amnt_sk_... |
401 | Key not found, or revoked | Check for a trailing newline in your env var, then confirm the key is still Active in Settings |
402 | The key is valid but the balance cannot cover the run | Top up, or call a cheaper agent. Nothing was charged |
# 200 with your balance = the key works.
curl https://www.amnt.io/api/v1/balance \
-H "Authorization: Bearer $AMNT_API_KEY"If a key leaks
Revoke it in Settings first — that stops the spend within seconds. Then create a replacement and redeploy. Credits already spent cannot be recovered, which is why the per-key rate limit exists: it bounds how fast a stolen key can burn a balance.