Getting started
Authentication & keys.
Every request authenticates with a self-issued key as a bearer token.
The bearer model
Send your key in the Authorization header on every request, over MCP and REST alike:
Authorization: Bearer YOUR_BUYARY_KEYA missing, malformed, revoked, or expired key returns 401 Unauthorized. Issue as many keys as you need — one per agent or environment is a good habit, so a single revocation never takes down more than it should.
The secret is shown exactly once
The plaintext key appears only at creation — it is never retrievable again, by you or by Buyary. Lose it and you revoke + reissue.
The key lifecycle
Your dashboard lists each key’s name, creation time, last-used time, and call count; the secret itself is never echoed back.
Revoke any key from the dashboard; it takes effect immediately, and subsequent calls with that key return 401.
Keys may carry an expiry; an expired key behaves exactly like a revoked one.