# Authentication and API key safety

Authenticate every REST call with a secret Bearer key stored on your backend.

```http
Authorization: Bearer mp_live_<43 URL-safe characters>
Content-Type: application/json
```

Create keys at [the dashboard](https://metaphrase.msalman.com/dashboard). A full key appears once; the database stores its HMAC hash and a visible prefix. Lost keys cannot be recovered. Create a replacement, update your backend environment, test it, then revoke the old key. Revocation blocks new calls immediately; an already accepted request may finish. Key names and usage remain visible after revocation.

Use environment variable `METAPHRASE_API_KEY`. Never use `NEXT_PUBLIC_METAPHRASE_API_KEY`, `VITE_*`, a frontend `.env`, mobile build constants, public JavaScript, browser storage, a repository, or an AI chat prompt for a secret key. AI integration prompts should mention the variable name, never its value. The Scalar playground sends a key you explicitly enter to this same API origin and does not persist it as saved authentication.

CORS is enabled on the REST API for compatibility with backend tooling and development. It is not a permission to expose a secret key in a browser. A browser sends text to **your backend proxy**; that backend reads the secret environment variable and calls MetaPhrase.

```text
Browser/mobile UI → your authenticated or rate-limited backend → MetaPhrase REST API
```

[The HTML recipe](https://metaphrase.msalman.com/docs/recipe-html.md) contains a complete Node server and page. [Next.js](https://metaphrase.msalman.com/docs/recipe-nextjs.md), [WordPress](https://metaphrase.msalman.com/docs/recipe-wordpress.md), [Laravel](https://metaphrase.msalman.com/docs/recipe-laravel.md), and [Python backends](https://metaphrase.msalman.com/docs/recipe-python.md) have dedicated examples. An API key belongs only in those server files.

Dashboard accounts use a 12-character minimum password, salted scrypt hashes and opaque HttpOnly, Secure, SameSite=Lax session cookies. Dashboard mutations require the same origin. API calls use Bearer keys, not dashboard cookies. Account creation is limited by IP; API keys inherit their account's plan.

Free defaults: five active keys, 15 calls per key per 60 seconds, 500 accepted calls per key per UTC month. Pro placeholders: 20 keys, 120/60 seconds, 25,000/month. Plans can be changed by the operator. No payments are collected. Limits are shared across all tools using a key.

Requests and outputs are not stored in the PostgreSQL usage log; it records metadata such as tokens, tool, key ID, status and estimated provider cost. Identical results are cached in private Redis for up to 24 hours. Submitted text is sent to the configured provider for generative tools; grammar, citations and extractive summaries do not use an LLM. Keep your own application logs from recording secrets or private writing.