# Authentication (/docs/authentication)



Every protected request carries a bearer token:

```text
Authorization: Bearer sk_viralquery_...
```

Get a key through an active **[subscription](/docs/get-api-key)**. Keys are shown once, so store
yours in a secure client secret or environment variable—never in a prompt, URL, or source file.

## What your key lets an agent do [#what-your-key-lets-an-agent-do]

A valid key can:

* set its one app or website workspace,
* update its research brief, including optional competitors,
* update plain-English research rules,
* run tenant-scoped scrolls,
* read its private library, outliers, trends, and hooks,
* save tenant-owned tags and notes on library videos,
* inspect its current usage.

Plan-gated requests need an active subscription (`402 subscription_required`). Daily research
capacity is enforced by the service; there is no monthly scroll gate. See
**[Subscription & usage](/docs/credits-and-billing)**.

## Rotation and recovery [#rotation-and-recovery]

ViralQuery stores only a hash of your key. If you lose or suspect a key, use the email-code
**[recovery flow](/docs/lost-key)** to rotate it. Rotation immediately invalidates the old key, so
update every MCP, CLI, and API configuration that used it.