# Manufact API keys and authentication (/dashboard/api-keys)

API keys authenticate programmatic access to your organization, from the REST API, CI pipelines, and scripts. Manage them on the **API Keys** page.![API keys list](/screenshots/dashboard/api-keys/api-keys-list.png)## Creating a key [#creating-a-key]![Create API key dialog](/screenshots/dashboard/api-keys/create-key-dialog.png)1) Go to **API Keys** and click **Create key**.
2) Give it a descriptive name (for example `ci-deploy`).
3) Pick an expiry, never, 7, 30, 90, or 365 days.
4) Copy the key immediately: it starts with `mcp_` and is shown only once.## Using a key [#using-a-key]Send it as a bearer token (an `x-api-key` header works too):```bash
curl -H "Authorization: Bearer mcp_..." \
  https://cloud.manufact.com/api/v1/servers
```See the [Manufact API docs](https://cloud.manufact.com/docs) for the full REST API reference.## CLI authentication [#cli-authentication]For interactive use, the [CLI](/cli) doesn't need an API key, `mcp-use login` opens a browser flow (or a device-code flow on headless machines) and stores a session. Use API keys for non-interactive environments like CI.## Security [#security]- Scope each key to one purpose and name it accordingly, so revoking is painless.
- Prefer expiring keys; rotate non-expiring keys periodically.
- Treat keys like passwords, keep them in your CI secret store, never in the repository.