authentication

send the key in a header

Authorization: Bearer brk_live_...

Every API, tool, file, and MCP request requires a live Brok key. A missing, malformed, revoked, or unknown key returns 401.

create, store, rotate, revoke

• Server-side onlyStore the key in a secret manager or environment variable. Never place it in browser, mobile, desktop, or public repository code.
• One app per keyUse descriptive key names so Usage can attribute traffic to the correct production application.
• Rotate safelyCreate a replacement, deploy it, verify traffic on the new key, then revoke the old key.
• Revocation is immediateRevoked keys stop authenticating and remain visible as metadata in the platform.