import { Button } from "zudoku/ui/Button";
import { Stepper } from "zudoku/ui/Stepper";

# Create an API Key

One Cafecito API key authenticates every **live** product: Beans and Espresso REST, plus `https://api.cafecito.tech/beans/mcp` and `https://api.cafecito.tech/espresso/mcp`. Cortado is a future product and do not accept this key yet.

There is no official SDK. Send the key as a Bearer token. [Health](/guides/api-conventions) routes are public.

<Stepper>
1. Open <Button className="btn-with-link" asChild><a href="/settings/api-keys">API Keys</a></Button> in the developer portal.
2. Create a key and store it in a secret manager or `CAFECITO_API_KEY`. Never commit it.
3. On every authenticated request, send: `Authorization: Bearer YOUR-API-KEY`
</Stepper>

## Example

~~~bash
curl -s --get "https://api.cafecito.tech/beans/articles/latest" \
  --data-urlencode "limit=5" \
  -H "Authorization: Bearer YOUR-API-KEY"
~~~

Use a separate key per application or environment and rotate a key if it leaks. All keys for the same user share the [free-tier meter](/guides/pricing-limits) (100 requests per minute and 50,000 per month; REST and MCP together).

## Next

- [First API call](/start/first-api-call)
- [API conventions](/guides/api-conventions)
- [Reusable clients](/guides/client-patterns)
- [Troubleshooting](/guides/troubleshooting)