> ## Documentation Index
> Fetch the complete documentation index at: https://docs.valkyrieapp.azumo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate requests to the Valkyrie API.

Valkyrie accepts two kinds of credentials.

## API keys (recommended for applications)

Send your key in the `X-API-Key` header:

```bash theme={null}
curl https://valkyrie-back.azumo.com/{deployment_slug}/v1/chat/completions \
  -H "X-API-Key: $VALKYRIE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "{deployment_slug}", "messages": [{"role":"user","content":"Hi"}]}'
```

Because the API is OpenAI-compatible, the OpenAI SDKs send the key as an
`Authorization: Bearer` header instead, Valkyrie accepts that too. Just set the
SDK's `api_key` to your Valkyrie key.

### Key prefixes

| Prefix    | Purpose                                            |
| --------- | -------------------------------------------------- |
| `vk_dep_` | Calling a deployed model                           |
| `vk_mcp_` | Connecting through the [MCP server](/mcp/overview) |

Create and revoke keys on the [API Keys](/dashboard/api-keys) screen.

## JWT bearer tokens (dashboard sessions)

People signed in to the dashboard authenticate with a session token
(`Authorization: Bearer <jwt>`). This is handled for you by the web app; you don't
normally use JWTs for programmatic access, use an API key instead.

## Good practices

<Warning>
  * Store keys in a secret manager or environment variables, never in source control.
  * Use a distinct key per application or environment so you can revoke narrowly.
  * Keys are **environment-specific**: a key issued in one environment will be
    rejected in another.
</Warning>