---
icon: material/security
title: "Authentication"
description: "How the 10x engine, the agent, and the MCP authenticate"
---

There are two credentials, used in two places.

## The per-environment key (engine and REST)

The 10x engine and every REST call authenticate with one header:

```
X-10X-Auth: <API_KEY>/<ENV_ID>
```

The key is the secret. The environment ID routes data to the right tenant
and is safe to put in config. The [MCP sign-in](../apps/mcp/tools/account/signin.md) mints it and
`log10x_rotate_api_key` rotates it; see [API Keys](api-keys.md).
Air-gapped engines authenticate offline with a signed `license.jwt` instead;
see [License](license.md).

## The MCP sign-in (agent)

The MCP server signs an operator in to a real account two ways:

- **Browser device flow.** `log10x_signin_start` returns a code and opens an
  Auth0 confirmation page. `log10x_signin_complete` polls for the token and
  writes `~/.log10x/credentials` (mode 0600).
- **Pasted key.** Call `log10x_signin_complete` with an `api_key` the operator
  already holds. No browser.

`log10x_login_status` reports who is signed in and which environments are
reachable. `log10x_signout` revokes the local credentials. With no
credentials, the MCP runs read-only against the public demo environment.

Identity for the account is handled by Auth0 (`auth.log10x.com`). The engine
and the REST API never see Auth0; they only check the per-environment key.