> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmagent.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API authentication and token management.

# Authentication

## API Keys

Generate API keys from **Settings > Integration > Agent API** in the GUI. Each key is prefixed with `sk-myrm-` and the plaintext is only shown once at creation time.

## Usage

Include the key in the `Authorization` header:

```bash theme={null}
Authorization: Bearer sk-myrm-...
```

## Key Management

| Feature      | Description                                                        |
| ------------ | ------------------------------------------------------------------ |
| **Create**   | Name, optional expiration (1–3650 days), and note                  |
| **List**     | View all keys with prefix, status, usage count, and last used time |
| **Revoke**   | Soft-disable a key (preserves history)                             |
| **Delete**   | Permanently remove a key                                           |
| **Security** | SHA-256 hashed storage; plaintext shown only at creation           |

## OpenAI Compatible API

Myrm exposes an OpenAI-compatible **Agent API** at `/v1`. External tools call configured agents (memory, tools, skills) — not raw LLM forwarding:

```bash theme={null}
curl http://localhost:8080/v1/chat/completions \
  -H "Authorization: Bearer sk-myrm-..." \
  -H "Content-Type: application/json" \
  -d '{"model": "default", "messages": [{"role": "user", "content": "Hello"}], "stream": true}'
```

### Agent API vs LLM proxy

* **Agent API (Myrm `/v1`)**: `model` is an agent ID or `"default"` → full Agent execution engine.
* **LLM proxy (Cursor/Codex)**: cross-provider raw LLM routing is out of scope for Myrm — use a separate external LLM gateway.

## Interactive API Docs (Swagger UI)

Visit `http://localhost:8080/docs` to explore the full API in an interactive Swagger UI.

| Deploy mode           | How to authenticate                                     |
| --------------------- | ------------------------------------------------------- |
| **Local / Tauri**     | No token needed — loopback requests are auto-trusted    |
| **WebUI Remote**      | Log in first; the session cookie is sent automatically  |
| **Sandbox / API Key** | Click **Authorize**, enter your API key, then **Apply** |

After authorizing, every **Try it out → Execute** call includes the `Authorization: Bearer <key>` header automatically. Lock icons next to each endpoint indicate whether credentials are active.

ReDoc is also available at `http://localhost:8080/redoc`.

## Token Rotation

Keys can be revoked or deleted at any time from the API Keys settings page. Revoked keys are immediately rejected.