---
title: Authentication
description: How to authenticate with the SeeLLM API using Firebase tokens or API keys.
audience: [human, agent]
type: reference
version: v1
stability: stable
lastVerified: "2026-08-01"
prerequisites: []
related: [/docs/api/, /docs/api/analytics-endpoints/, /docs/mcp/setup/]
artifacts: []
---

## API Keys

API keys are the simplest way to authenticate. They're ideal for server-to-server integrations and MCP connections.

### Creating an API Key

1. Go to [app.seellm.com](https://app.seellm.com)
2. Navigate to **Settings > API Keys**
3. Click **Create API Key**
4. Give it a descriptive name (e.g., "Production Dashboard", "MCP Integration")
5. Copy the key immediately — it won't be shown again

### Using API Keys

Include the key in the `Authorization` header:

```bash
curl https://api.seellm.link/api/analytics/traffic-overview?range=7d \
  -H "Authorization: Bearer sk_live_your_api_key_here"
```

### Key Format

All API keys start with `sk_live_` followed by a random string. Keys are hashed (SHA-256) before storage — SeeLLM never stores your raw key.

### Scopes

API keys inherit the permissions of the organization they belong to. They can access all analytics data for that organization.

## Firebase Auth (Web App)

The SeeLLM web dashboard uses Firebase Authentication with Google Sign-In. If you're building a custom frontend:

```typescript
import { getAuth, getIdToken } from 'firebase/auth';

const auth = getAuth();
const token = await getIdToken(auth.currentUser!);

const response = await fetch(
  'https://api.seellm.link/api/analytics/traffic-overview?range=7d',
  {
    headers: {
      Authorization: `Bearer ${token}`,
    },
  }
);
```

Firebase tokens expire after 1 hour and are automatically refreshed by the Firebase SDK.

## Error Responses

| Status | Meaning |
|--------|---------|
| `401` | Missing or invalid authentication |
| `403` | Valid authentication but a resource-scoping check rejects access |
| `500` | Current documented mutation write-role checks throw rather than returning an advertised `403` |
| `429` | Rate limit exceeded |