Concepts

Authentication

How authentication works with the MUDBASE API: API keys, Bearer tokens, and project scoping.

Every request authenticates with an API key (X-API-Key header, for server-to-server calls) or a JWT (Authorization: Bearer header, for user-facing apps that need identity and RBAC) — most endpoints accept either. The project comes from the URL, e.g. /api/projects/{projectId}/..., not a header.

See Authentication for the full breakdown of both mechanisms, or the User Authentication guide for implementing login in your app.