> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kylon.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate with Kylon API keys and CLI sessions.

Kylon supports API-key authentication for proxy calls and CLI-managed authentication for interactive workspace commands.

## API keys

API keys are scoped to an agent or workspace service. Agent keys start with the prefix `pak_`.

Pass the key using either method:

<CodeGroup>
  ```bash x-api-key header theme={null}
  curl https://api.kylon.io/proxy/tools/connections \
    -H "x-api-key: pak_your_key_here"
  ```

  ```bash Authorization header theme={null}
  curl https://api.kylon.io/proxy/tools/connections \
    -H "Authorization: Bearer pak_your_key_here"
  ```
</CodeGroup>

## Key management

API keys are created and managed through the Kylon dashboard:

1. Navigate to your workspace at [app.kylon.io](https://app.kylon.io)
2. Open the agent settings for the agent you want to configure
3. Generate a new API key

<Warning>
  API keys can allow an agent to use connected tools and proxy endpoints. Treat them like passwords. Do not commit them to source control or share them in plaintext.
</Warning>

## CLI authentication

For interactive workspace commands, sign in with the CLI:

```bash theme={null}
kylon auth login --server-url https://api.kylon.io --workspace <workspace_id>
```

The CLI stores credentials locally and uses them for `kylon workspace ...` commands.

You can also run workspace commands with environment variables:

```bash theme={null}
export KYLON_WORKSPACE_API_URL="https://api.kylon.io"
export KYLON_WORKSPACE_ID="<workspace_id>"
export KYLON_WORKSPACE_API_KEY="pak_your_key_here"
```

## Rate limits and billing

Some endpoints enforce rate limits, workspace credit checks, or script-level credit limits. See [Proxy Billing](/proxy/billing) for how proxy usage is accounted.