> For the complete documentation index, see [llms.txt](https://docs.mansafi.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.mansafi.xyz/api-reference/auth-and-keys.md).

# Auth & Keys

The REST API puts accounts, transfers, and agent wallets behind a single bearer token. Every call requires an API key belonging to a MansaFi account.

***

## Minting a key

Keys come from the **Developer** area of your dashboard:

1. Sign in to your MansaFi account
2. Go to **Dashboard → Developer → API Keys**
3. Press **Generate New Key**
4. Name it — `production`, `dev`, `internal-tool`
5. Copy it somewhere safe; it is displayed once

A key is scoped to the account that minted it. Transfers you initiate over the API carry precisely the confidentiality guarantees of transfers made in the app. The privacy layer does not thin out because the caller is code.

***

## Sending it

Put the key in the `Authorization` header on every request:

```
Authorization: Bearer <your_api_key>
```

For example:

```bash
curl -X POST https://api.mansafi.xyz/v1/transfers \
  -H "Authorization: Bearer hc_live_xxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "to": "@vendor",
    "amount": "125.00",
    "asset": "USDG",
    "confidential": true,
    "memo": "Invoice #4471"
  }'
```

***

## Two kinds of key

| Prefix     | Network | Purpose                                         |
| ---------- | ------- | ----------------------------------------------- |
| `hc_live_` | Mainnet | Production; produces real on-chain transactions |
| `hc_test_` | Testnet | Development; no real USDG required              |

Integrate against test keys. Testnet calls run on the Robinhood Chain testnet (chain ID 46630) and never touch mainnet (chain ID 4663) or real funds.

***

## Managing keys

The dashboard lets you:

* **List** every key with its last-used timestamp
* **Revoke** any key, effective immediately
* **Inspect usage** per key: request count and total USDG moved

***

## Handling them safely

* Keep keys in environment variables or a secrets manager, never in source control.
* Rotate the moment you suspect exposure.
* Use a distinct key per environment.
* Revoke anything you have stopped using.

A live key can move funds out of your account. Treat it as you would a private key.

***

## The limit of what a key can do

No API key will ever decrypt a transaction amount server-side on your behalf. That boundary is structural rather than procedural. An integration that needs a confidential figure must decrypt it on the client with your account's decryption key, exactly as the MansaFi app does.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.mansafi.xyz/api-reference/auth-and-keys.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.