# Account API Keys

An **Account API Key** authenticates programmatic calls to MewCP's management APIs. Your backend uses this key to start OAuth flows for audience, get hosted credential form URLs, and manage audience member credential state via the [MewCP Auth API](/mewcp-auth).

---

## Format

```
mewcp_acct_<hex_token>
```

Example: `mewcp_acct_7df44e73e8cd42bbf4860ffc66520efb62d973615dc2c0f7fb5607fb82d75b53`

---

## How to get one

<Stepper>

1. Go to **Dashboard -> Developer -> Account API Keys**
1. Click **Generate Key**, give it a label, and copy the key

</Stepper>

---

## How to use it

Pass it as a Bearer token in the `Authorization` header. Every MewCP Auth API endpoint also requires an `x-mewcp-key` header: the API Key of the specific business-mode server you're acting on (see [API Key](/mewcp/authentication/mewcp-key)). The two are not interchangeable and both are required:

```bash
curl https://gateway.mewcp.com/end-users \
  -H "Authorization: Bearer mewcp_acct_YOUR_KEY" \
  -H "x-mewcp-key: mcp_live_YOUR_SERVER_KEY"
```

TypeScript:

```typescript
const res = await fetch("https://gateway.mewcp.com/end-users", {
  headers: {
    Authorization: `Bearer ${process.env.MEWCP_ACCOUNT_KEY}`,
    "x-mewcp-key": process.env.MEWCP_SERVER_KEY,
  },
});
```

Python:

```python
import httpx
resp = httpx.get(
    "https://gateway.mewcp.com/end-users",
    headers={
        "Authorization": f"Bearer {MEWCP_ACCOUNT_KEY}",
        "x-mewcp-key": MEWCP_SERVER_KEY,
    },
)
```

---

## What you can do with it

| Action                               | Endpoint                                          |
| ------------------------------------ | ------------------------------------------------- |
| Start OAuth flow for a user          | `POST /oauth/{provider}/start`                    |
| Get hosted static credential form    | `POST /credentials/static/{providerSlug}/connect` |
| List audience for a server           | `GET /end-users`                                  |
| Get an audience member's credentials | `GET /end-users/{externalUserId}`                 |
| Revoke a user's credential           | `DELETE /end-users/{externalUserId}`              |

Every action above is scoped to the single server identified by `x-mewcp-key`. There's no call that lists or manages audience across every server at once.

Full reference in the [MewCP Auth API](/mewcp-auth) docs.

---

## Best practices

- **Keep it server-side only.** Never expose Account API Keys in frontend code or mobile apps.
- **One key per environment.** Use separate keys for production, staging, and local development.
- **Revoke if compromised.** Go to **Developer -> Account API Keys** and click **Revoke**.