The bearer model

Send your key in the Authorization header on every request, over MCP and REST alike:

header
Authorization: Bearer YOUR_BUYARY_KEY

A missing, malformed, revoked, or expired key returns 401 Unauthorized. Issue as many keys as you need — one per agent or environment is a good habit, so a single revocation never takes down more than it should.

The secret is shown exactly once

The plaintext key appears only at creation — it is never retrievable again, by you or by Buyary. Lose it and you revoke + reissue.

The key lifecycle

Metadata, not secretsdashboard

Your dashboard lists each key’s name, creation time, last-used time, and call count; the secret itself is never echoed back.

Revocationimmediate

Revoke any key from the dashboard; it takes effect immediately, and subsequent calls with that key return 401.

Expiryoptional

Keys may carry an expiry; an expired key behaves exactly like a revoked one.