# Authentication

> Documentation index for AI agents: [/llms.txt](https://docs.apiindonesia.id/llms.txt). Every page is also available as markdown: add `.md` to the URL.

API keys, the x-api-key header, MCP bearer auth and keeping keys secret.

## REST API: x-api-key header

Every data endpoint needs an API key in the `x-api-key` header:

```bash
curl "https://use.apiindonesia.id/api/v1/libur/upcoming" \
  -H "x-api-key: aip_live_xxx"
```

Create keys in the dashboard at [dashboard.apiindonesia.id](https://dashboard.apiindonesia.id) under **API Keys**. Keys start with `aip_live_`. A missing or invalid key returns `401` (see [Errors](https://docs.apiindonesia.id/errors.md)).

## MCP server: Authorization header

The MCP server at `https://mcp.apiindonesia.id/mcp` takes the same API key as a bearer token:

```text
Authorization: Bearer aip_live_xxx
```

See [MCP server and agents](https://docs.apiindonesia.id/mcp.md) for client setup.

## Keep keys secret

Treat a key like a password. Do not commit it, paste it into shared files or expose it in browser code. If a key leaks, create a new one in the dashboard and delete the old one.

## Account endpoints

The dashboard itself uses these endpoints. Endpoints under `/user` and `/billing` (and `/auth/me`) take a dashboard session token as `Authorization: Bearer`, not an API key. Most integrations never need them.

| Method | Path | Summary |
| --- | --- | --- |
| POST | `/auth/register` | Register |
| POST | `/auth/login` | Log in |
| GET | `/auth/me` | Get current user |
| GET | `/user/keys` | List API keys |
| POST | `/user/keys` | Create an API key |
| DELETE | `/user/keys/{id}` | Revoke an API key |
| GET | `/user/usage` | Usage statistics |
| GET | `/billing/plans` | Plan list |
| POST | `/billing/subscribe` | Start checkout |
| GET | `/billing/status` | Subscription status |
| POST | `/billing/webhook` | Sumopod webhook |
| POST | `/billing/topup` | Buy credits (pay as you go) |
| GET | `/billing/credits` | Credit balance |