> ## Documentation Index
> Fetch the complete documentation index at: https://docs.alshival.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Create, rotate, and apply API keys for logs and MCP

## Create a key

1. Open DevTools account settings.
2. Create an API key.
3. Store it in your secrets manager.
4. Inject it at runtime.

## Key usage patterns

| Use case      | Required headers                | Notes                                                      |
| ------------- | ------------------------------- | ---------------------------------------------------------- |
| Resource logs | `X-API-Key`                     | Identity is inferred from URL path ownership + key context |
| Unified MCP   | `X-API-Key` + `X-User-Username` | User-scoped capability checks                              |
| GitHub MCP    | `X-API-Key` + `X-User-Username` | Requires connected GitHub account                          |

## MCP auth check

```bash theme={null}
curl -sS https://mcp.alshival.ai/mcp/ \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $ALSHIVAL_API_KEY" \
  -H "X-User-Username: $ALSHIVAL_USERNAME" \
  -d '{"jsonrpc":"2.0","id":"1","method":"tools/list","params":{}}'
```

## Security requirements

* Never commit keys to source control.
* Use one key per deployed service.
* Rotate keys immediately after exposure.