---
title: "Authentication"
description: "Key formats, account modes, rotation and per-key controls."
canonical_url: "https://minirouter.sh/docs/authentication"
markdown_url: "https://minirouter.sh/docs/authentication.md"
last_updated: "2026-08-04"
---

# Authentication

One header:

    Authorization: Bearer mr-live-<26 base58>

Keys are created before any payment. Two equal entry paths
(https://minirouter.sh/start): accountless at https://minirouter.sh/key, or an
account signed in with an email or Solana wallet (passwordless). Same prices,
same key format, same API behaviour either way. We store the 14-char prefix and
a sha256 hash, never the key itself.

## Accountless mode

No email or wallet identity is required. A Turnstile check protects anonymous
account creation without becoming an account. Setup returns two bearer secrets:
the API key for clients and a permanent dashboard link for browser access. Both
must be saved before a payment address is shown. The link survives API-key
rotation; if every usable key and the link are lost, there is no personal recovery.

## Account mode

Sign in with an email or a Solana wallet, passwordless either way. You get
personal account recovery. Plaintext keys still cannot be recovered because
only their hashes are stored, but a saved dashboard link or signed-in session
can create a replacement. Browser-push and email credit alerts are optional.

## Claim an account later

POST /me/claim (authenticated with the key) attaches an email or wallet to an
accountless account, using the key as proof of control:

    curl https://api.minirouter.sh/me/claim \
      -H "Authorization: Bearer $MINIROUTER_KEY" \
      -H "Content-Type: application/json" \
      -d '{"email":"you@example.com"}'

## Rotation: 24-hour grace

POST /keys/:id/rotate returns the new key and the old key's expiry, 24 hours
out. The old key keeps working for the grace window so a running agent is not
cut off mid-task. 401s reference
https://minirouter.sh/docs/errors#invalid_api_key

## Per-key controls

- rpmLimit: requests per minute
- tpmLimit: estimated input and output tokens per minute
- dailyLimitNano: daily spend cap in nano-USD
- monthlyLimitNano: monthly spend cap in nano-USD
- allowedModels: models this key may call

Spend caps are on by default, and lower by default for accountless keys.