> ## Documentation Index
> Fetch the complete documentation index at: https://docs.podcastor.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Use an API key tied to your Podcastor account and Space.

Manage keys from [Account > API key](https://podcastor.ai/profile?tabKey=api). You can create, reveal, copy, reset and revoke a key.

```http theme={null}
X-Api-Key: YOUR_API_KEY
Content-Type: application/json
```

Store the key on your server. Do not embed it in public frontend code, URLs or committed examples. Reset or revoke a key when it should no longer have access.

## Account and Space

Each request uses the account and Space attached to the key. The server checks current account status, membership and access to the requested resource. A request cannot choose another billing identity by adding headers or body fields.

Projects and assets use the same ownership rules as the Web app, including its public and user libraries. Webhook subscriptions are account-wide; see [Webhook availability](/api-reference/guides/webhooks).

Revoking a key stops subsequent authenticated calls. It does not cancel tasks that were already accepted or refund completed work.

## API keys and OAuth

| Channel  | Authentication                                |
| -------- | --------------------------------------------- |
| JSON API | `X-Api-Key`                                   |
| MCP      | `X-Api-Key` **or** OAuth2 Bearer access token |

Do not send an `Authorization` header to the JSON API. Do not send both credential types to MCP. For delegated assistant access, use the MCP OAuth flow.