# Authentication

This page covers authentication for the **REST API and the SDKs**, where the credential is an API key. Vibedasher has two access tiers here: the **authenticated API** (an API key) and a small **public, no-auth surface**.

Driving Vibedasher from your agent over MCP?

You don't need a key. Install `vibedasher-mcp` (**0.6.0 or later**) and run `vibedasher login` — browser sign-in, session in your OS keyring. See **[Build with your agent](/guides/build-with-your-agent.md)**. API keys are for the SDKs, for your own backend, and for headless/CI machines where no browser can open.

## API key (`X-Api-Key`)[​](#api-key-x-api-key "Direct link to api-key-x-api-key")

The authenticated API — datasets, SQL, visualizations, connections, and more — is accessed with an **API key** sent in the `X-Api-Key` header. That's how both SDKs authenticate, and how the [MCP server](/guides/build-with-your-agent.md) authenticates on a headless or CI machine (via `VIBEDASHER_API_KEY`, which takes precedence over any stored login session when it is set).

### Get a key[​](#get-a-key "Direct link to Get a key")

Mint a key in the app under **Settings → API keys** at [cloud.vibedasher.com](https://cloud.vibedasher.com). Key creation is deliberately **admin-only and browser-session-only**: `POST /v1/api-keys` requires an account admin signed in through the app and rejects API-key auth outright, so it is not part of the SDK surface and you will not find it in the reference. A key cannot mint another key, and a non-admin member cannot self-provision one — that is the point.

Treat a key like a password: it carries your account's access. Store it in an environment variable or a secret store, never in source control.

### Send it[​](#send-it "Direct link to Send it")

```
curl https://api.vibedasher.com/api/v1/datasets \

  -H "X-Api-Key: $VIBEDASHER_API_KEY"
```

The [official SDKs](/api/sdks.md) wire this header for you — you just pass the key when you construct the client:

```
import { Vibedasher } from '@vibedasher/client';



const client = new Vibedasher({

  apiKey: process.env.VIBEDASHER_API_KEY!,

});



const page = await client.datasets.list({ limit: 50 });
```

```
from vibedasher import Vibedasher



client = Vibedasher(api_key="<your-api-key>")



client.datasets.list()
```

### One host, routed by your credential[​](#one-host-routed-by-your-credential "Direct link to One host, routed by your credential")

`https://api.vibedasher.com/api` is the default base URL, and it is the only address you need to know. The edge in front of it reads your credential — the prefix of your `X-Api-Key`, or the region recorded inside a browser session token — and forwards the request to the region that holds your account's data. Your code never has to say where that is. (`region` is optional from `@vibedasher/client` 4.1.5 and `vibedasher` 4.3.19 onwards.)

Every region also answers on its own hostname, `https://api.{region}.vibedasher.com/api`. Those addresses are fully supported and they are the way to **pin** a client to one region deliberately: pass `region` to either SDK, or set the base URL by hand. An ejected dashboard does exactly that — it records the regional host it was built against, so the bundle you ship keeps querying the same place.

A request that carries no credential at all — the public endpoints below, and every CORS preflight — is served by the default region, `eu-central-1`.

## Public endpoints — no auth[​](#public-endpoints--no-auth "Direct link to Public endpoints — no auth")

The endpoints under `/v1/public/*` require **no** authentication. They serve only content that has been explicitly **published and marked public**:

```
curl https://api.vibedasher.com/api/v1/public/viz/slug/<slug>
```

Drafts and private dashboards return `404` — there is no way to read unpublished data through the public surface.

Because these calls carry no credential, there is nothing for the edge to route on, so they reach the default region. If your account's data lives elsewhere, address the public lane at your own region's hostname instead.

## What's never exposed[​](#whats-never-exposed "Direct link to What's never exposed")

Pure infrastructure and admin plumbing is excluded from the API entirely — admin cache/job/ worker management, the AI-debug and observability viewers, cross-account analytics, WebSocket transport, and direct function invocation. These power the app internally and are not part of the documented surface.

note

Need something the API doesn't cover yet? Reach out via the [contact page](https://vibedasher.com/contact).