> ## Documentation Index
> Fetch the complete documentation index at: https://docs.salesgraph.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How Salesgraph API keys work and how to send them.

Every request to the MCP server must be authenticated with a Salesgraph API key. A key
identifies your **organization** — all tool calls run scoped to that org's data and connected
integrations.

## API keys

Keys are created and revoked from [Settings → API Keys](https://salesgraph.com/dashboard/settings/api-keys).

* Keys are prefixed with `sg_live_`.
* The full key is shown **only once**, at creation. Store it securely.
* Only a short prefix (e.g. `sg_live_ab12…`) is ever displayed afterward, so you can tell keys apart.
* Keys don't expire, but you can revoke any key at any time. Revocation takes effect immediately.

<Tip>
  Use a separate key per integration or environment (e.g. one for production, one for local
  testing). That way you can revoke a single key without disrupting everything else.
</Tip>

## Sending the key

Send your key on every request using either header:

<CodeGroup>
  ```http Authorization (recommended) theme={null}
  Authorization: Bearer sg_live_xxxxxxxxxxxx
  ```

  ```http x-api-key theme={null}
  x-api-key: sg_live_xxxxxxxxxxxx
  ```
</CodeGroup>

Most MCP clients have a dedicated field for the URL and a place to add a custom header — use
the `Authorization: Bearer <key>` form there.

## Unauthorized responses

A missing, malformed, or revoked key returns:

```json theme={null}
{ "error": "unauthorized" }
```

with HTTP status `401` and a `WWW-Authenticate: Bearer` header.

## Scope and isolation

* A key only ever accesses the organization it was created for.
* Async runs ([GTM audits](/tools/gtm-audit), [org audits](/tools/org-audit)) are also scoped to
  the org: polling a run id that belongs to another org returns `not found`.
* Which tools return enriched results depends on the integrations connected to your org. Check
  with [`list_capabilities`](/tools/list-capabilities).