# Authentication

Every surface — REST, SDK, CLI, and MCP — authenticates with the same API
keys. Create and revoke them in the [ThinkBench app](https://app.thinkbench.com) under
**Settings → API keys**. Keys are secrets: send them only in headers, never
in URLs, and rotate any key that leaks.

## API keys

Pass the key in the `x-api-key` header:

```bash
curl "https://app.thinkbench.com/api/v1/drives" \
  -H "x-api-key: $THINKBENCH_API_KEY"
```

A key acts as the user who created it: requests can reach exactly what that
user can reach, nothing more. Requests without a valid key receive a `401`
with a JSON error envelope.

Remote MCP clients can use OAuth 2.1 instead of a key — see
[MCP server](/mcp).

## Agent attribution

When software edits a document on your behalf, ThinkBench records **who**
(the user behind the credential) and **via what** (the agent). Attribution
changes who gets credited in version history — never what is authorized.

Two ways to declare an agent:

- Create an **agent key** in Settings, which carries its agent name in the
  key itself.
- Send an `x-thinkbench-agent: <name>` header (the SDK's `agent` config and
  the CLI's `THINKBENCH_AGENT` variable do this for you).

Remote MCP clients connected over OAuth are attributed automatically by
their registered client name.