> ## Documentation Index
> Fetch the complete documentation index at: https://video2ctx-feat-polar-billing.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate hosted requests with a CLI session or personal key.

## Agent and CLI access

The hosted video2ctx skills use the public CLI package. Install it once, then start device authorization:

```bash theme={null}
npm i -g @video2ctx/cli
video2ctx auth login
```

The command opens `video2ctx.dev` and displays a short code. Sign in, confirm that the code and account are correct, and approve the device. The CLI stores the resulting revocable session in local user configuration with private file permissions. Check it with `video2ctx auth status --json` or `video2ctx whoami --json`, and revoke it with `video2ctx auth logout`.

CLI sessions carry `data:read` and `account:access`. They can use provider data, usage, monitors, and notifications. API-key management, billing, connected-account changes, account deletion, and administration remain browser-session-only.

## Personal API keys

For unattended server-to-server applications, create a personal key and use the standard `Authorization` header:

```http theme={null}
Authorization: Bearer aty_…
```

`X-API-Key` remains available for compatibility, but bearer authentication is preferred. Browser sessions, CLI sessions, and API keys share the same account and credit ledger.

## Permissions

Personal API keys can access normal user-owned data, projects, imports, exports, monitors, notifications, and usage. The published agent skills intentionally expose a narrower surface; the public OpenAPI contract remains the source of truth for each route's accepted credential type.

## Key safety

* Keep keys in server-side secrets or environment variables.
* Never embed a key in a public web bundle or mobile application.
* Use separate keys for separate integrations so one can be revoked independently.
* Revoke a key immediately if it appears in logs, screenshots, source control, or support messages.

<Warning>
  Never paste a CLI session or API key into an agent prompt. Local demo identities are development-only; production rejects the `X-Demo-User` header.
</Warning>