# API keys

An API key lets a script or an AI assistant act on your Apps as you. Every request to the
Passion API and the Passion MCP needs one.

## What a key is

- A key starts with `psn_key_`, for example `psn_key_3fJk…`.
- A key reaches only the Apps you chose for it. A request about another App is refused, even
  when you own that App.
- A key is **read** or **full**. A read key can only read. A full key can also make changes,
  such as publishing a community post. See [Scopes](/guides/scopes/).
- No key can delete anything or move money.
- You see the key once, when it is created. Passion keeps only a hash of it, so nobody at
  Passion can show it to you again. If you lose it, get a new one.
- Passion records when the key was last used, and every change it made.

## Get a key

Creating keys yourself in Passion Studio is coming soon.

Until then, ask Passion support for a key. Tell them:

1. a name for the key, for example "Claude Code on my laptop";
2. the Apps the key must reach;
3. read or full access. Choose read unless the tool must make changes.

## Send the key

Send the key in the `Authorization` header of every request:

```http
Authorization: Bearer psn_key_…
```

For example:

```sh
curl https://api.passion.io/v1/apps/12345/overview \
  -H "Authorization: Bearer psn_key_…"
```

A request with no key, an unknown key or a revoked key gets `401` with the code `unknown_key`.
See [Errors](/guides/errors/).

## Keep the key safe

- Treat the key like a password. Do not put it in a file that you share or commit.
- Use a different key for each tool, so you can stop one tool without stopping the others.
- If a key leaks, ask Passion support to revoke it. A revoked key stops working on the next
  request.