> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pullstory.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create requests require a bearer token; story polling is public by ID.

## Bearer tokens

Every story creation request needs an `Authorization` header with your API key:

```bash theme={null}
Authorization: Bearer ps_live_...
```

`POST /stories` requests without a valid key return `401 Unauthorized`.
`GET /stories/{id}` is public so clients and viewers can poll a known story ID.

## Creating an API key

<Steps>
  <Step title="Sign in to the dashboard">
    Visit [pullstory.com/dashboard](https://pullstory.com/dashboard) and sign in with GitHub.
  </Step>

  <Step title="Open API Keys">
    Navigate to [pullstory.com/dashboard/api-keys](https://pullstory.com/dashboard/api-keys).
  </Step>

  <Step title="Click 'Create key'">
    Give it a descriptive name (e.g. "CI pipeline" or "Claude Code MCP"). The full secret is shown **only once** — copy it immediately.
  </Step>

  <Step title="Store it securely">
    Put it in a secret manager, `.env.local`, or your CI provider's secrets UI. Never commit it to a repo.
  </Step>
</Steps>

## Key prefixes

| Prefix     | Environment           |
| ---------- | --------------------- |
| `ps_live_` | Production            |
| `ps_test_` | Sandbox (coming soon) |

## Permissions

Every key is scoped to **your user account** and respects the same plan limits as the web dashboard. A key can:

* Create pull stories from structured briefs

A key **cannot** access other users' data.

## Revoking a key

Revoking happens instantly — any in-flight request using that key will fail on the next call.

<CodeGroup>
  ```bash Dashboard theme={null}
  # pullstory.com/dashboard/api-keys → click Revoke
  ```
</CodeGroup>

<Warning>
  If a key is leaked, revoke it immediately and issue a new one. Generation requests made with the leaked key between leak and revocation still count against your minute quota.
</Warning>

## Rotating keys

There's no forced rotation, but best practice:

* One key per integration (Claude Code MCP, CI, internal scripts)
* Rotate every 90 days for production keys
* Rotate immediately on team member departure

## Next steps

<CardGroup cols={2}>
  <Card title="Quickstart" icon="rocket" href="/quickstart">
    Make your first authenticated request.
  </Card>

  <Card title="MCP setup" icon="plug" href="/integrations/mcp-setup">
    Wire the API into Claude Code.
  </Card>
</CardGroup>