> ## Documentation Index
> Fetch the complete documentation index at: /docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate with an API key

> Use an AmzDownloader API key safely with REST and MCP, keep credentials on your server, and understand rejected or revoked key responses.

AmzDownloader uses the same account API key for REST and MCP. Create or select a key in your [API keys page](https://amzdownloader.com/dashboard/api-keys), then send it in the `Authorization` header.

```http theme={null}
Authorization: Bearer YOUR_AMZDOWNLOADER_API_KEY
```

## Keep credentials private

Store keys in environment variables or your client's secret store. Do not put keys in source control, URL parameters, browser applications, analytics, or screenshots. Send your key only to `https://amzdownloader.com`. Media download URLs do not need your AmzDownloader key.

Jobs belong to your account. A valid replacement key for the same account can poll and retrieve jobs created before rotation. Another customer's key cannot access your jobs even if that customer knows the job ID.

## Rename, rotate or revoke a key

Use the row menu on the [API keys page](https://amzdownloader.com/dashboard/api-keys) to rename, rotate or revoke a key. Renaming changes its label. Rotation creates a replacement whose secret is shown once; store it in your secret manager and update your integrations.

The previous key remains valid for 24 hours after rotation unless you revoke it sooner. Revocation stops that key immediately. You can use the replacement to finish existing jobs because their ownership stays with your account. Accounts can have ten still-valid keys, including keys within their rotation overlap. If you reach the limit, revoke an unused key before creating or rotating another.

## Handle rejected keys

A missing, invalid or revoked key returns HTTP `401`. Check that the environment variable is present and that you sent one supported credential header. HTTP `403` means the request is authenticated but access is denied.

Read [errors and retries](/docs/errors.md) before retrying a failed request. MCP connection instructions are in the [agent guide](/docs/mcp-guide.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.