> This page is for version v8.3.0 (default).
> For other versions, use one of these documentation indexes:
> - v8.3.0 (default): https://docs.workflows.com/v-8-3-0/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.workflows.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.workflows.com/_mcp/server.

# Authentication

![Mind Reasoner API](/_fern-img/466e07efd0202b28f29ec8dda3be88918c85104c2652efceb8ff717127f861ca.webp)

> **Simple and Secure**
>
> Mind Reasoner API uses
>
> Bearer token
>
> authentication. Every request requires your
>
> API key
>
> in the Authorization header—no complex OAuth flows or token refresh mechanisms.

## Getting Your API Key

#### Access Your Dashboard

Log in to your [Mind Reasoner account](https://app.workflows.com) and navigate to your

account dashboard

or settings.

#### Generate API Key

Click "Generate API Key" or locate your existing key. Copy it immediately—you won't be able to view it again.

#### Store Securely

Save your API key in a secure location like a password manager or

environment variable

. Never commit it to version control.

---

## Making Authenticated Requests

Include your API key in the `Authorization` header of every request:

**`cURL`**

```bash title="cURL"
curl -X POST https://api.reasoner.com/api/mindsim/minds \
  -H "Authorization: Bearer {{YOUR_API_KEY}}" \
  -H "Content-Type: application/json" \
  -d '{"name": "Example Mind"}'
```

**`Node.js`**

```javascript title="Node.js"
import axios from 'axios';

const apiKey = '{{YOUR_API_KEY}}';
const url = 'https://api.reasoner.com/api/mindsim/minds';

const response = await axios.post(url,
  { name: 'Example Mind' },
  {
    headers: {
      'Authorization': `Bearer ${apiKey}`,
      'Content-Type': 'application/json'
    }
  }
);
```

**`Python`**

```python title="Python"
import requests

api_key = '{{YOUR_API_KEY}}'
url = 'https://api.reasoner.com/api/mindsim/minds'

headers = {
    'Authorization': f'Bearer {api_key}',
    'Content-Type': 'application/json'
}

response = requests.post(url,
    headers=headers,
    json={'name': 'Example Mind'}
)
```

> **Authorization Header Format**
>
> The format is: `Authorization: Bearer YOUR_API_KEY`
>
> Note the space between "Bearer" and your key. This is required.

---

## Best Practices

🔒

### Never Expose Keys

* Don't commit API keys to Git repositories
* Don't include keys in client-side code
* Don't share keys in screenshots or messages
* Use environment variables instead

🔄

### Rotate Regularly

* Generate new keys periodically
* Rotate immediately if compromised
* Keep backup keys for zero-downtime rotation
* Revoke old keys after rotation

⚙️

### Use Environment Variables

* Store keys in `.env` files (add to `.gitignore`)
* Use platform environment variables in production
* Never hardcode keys in source code
* Access via `process.env` or equivalent

---

## Environment Variables

Store your API key in environment variables for different platforms:

#### Local Development

### .env File

Create a `.env` file in your project root:

```bash
MIND_REASONER_API_KEY=your_actual_api_key_here
```

Add `.env` to your `.gitignore`:

```bash
echo ".env" >> .gitignore
```

Access in your code:

**`Node.js`**

```javascript title="Node.js"
import dotenv from 'dotenv';
dotenv.config();

const apiKey = process.env.MIND_REASONER_API_KEY;
```

**`Python`**

```python title="Python"
import os
from dotenv import load_dotenv

load_dotenv()
api_key = os.getenv('MIND_REASONER_API_KEY')
```

#### Production

### Platform Environment Variables

Set environment variables in your deployment platform:

**Vercel:**

```bash
vercel env add MIND_REASONER_API_KEY
```

**Heroku:**

```bash
heroku config:set MIND_REASONER_API_KEY=your_key
```

**AWS Lambda:**
Configure in AWS Console → Lambda → Configuration → Environment variables

**Docker:**

```bash
docker run -e MIND_REASONER_API_KEY=your_key your-image
```

---

## Authentication Errors

### 401 Unauthorized

**Cause:** Invalid or missing API key

**Response:**

```json
{
  "error": "Unauthorized",
  "message": "Invalid or missing API key"
}
```

**Solutions:**

* Verify your API key is correct
* Check the Authorization header format
* Ensure there's a space between "Bearer" and your key
* Confirm the key hasn't been revoked

### 403 Forbidden

**Cause:** Valid key but insufficient permissions

**Response:**

```json
{
  "error": "Forbidden",
  "message": "Your account doesn't have access to this resource"
}
```

**Solutions:**

* Check your account subscription level
* Verify the resource exists and belongs to your account
* Contact support if you believe this is an error

---

## Security Checklist

> **Security First**
>
> Follow this checklist to keep your API keys secure:
>
> * [ ] API keys stored in environment variables, not code
> * [ ] `.env` files added to `.gitignore`
> * [ ] Keys never committed to version control
> * [ ] HTTPS used for all API requests
> * [ ] Keys rotated every 90 days
> * [ ] Old keys revoked after rotation
> * [ ] Keys not shared in messages or screenshots
> * [ ] Server-side API calls only (not client-side)

---

## What's Next?

💡

### Learn Core Concepts

Understand minds, snapshots, and simulations in the [Core Concepts](/core-concepts) guide.

🚀

### Start Building

Follow the [Quick Start](/api-quick-start) guide to create your first mind and run simulations.

📚

### API Reference

Explore all endpoints, parameters, and responses in the complete [API Reference](/api-reference).