# Authentication

Bria authenticates every API request with an organization-level API token.

## Create a token

1. Sign in to the [Bria Console](https://platform.bria.ai/organization-management/api-keys).
2. Open **Organization management → API keys** and create a key. Give it a name that identifies the application that will use it.
3. Copy the value once and store it in a secret manager or an environment variable. You can create several keys per organization and revoke any of them at any time.


If you are signed in to the Console, your organization's active token appears here, and the **Try it** panel on every endpoint page sends it automatically.

div
[Get your API token](https://platform.bria.ai/organization-management/api-keys)

## Send the token

Pass the token in the `api_token` request header:

Python SDK
```python
from bria_client import BriaSyncClient

client = BriaSyncClient()                         # reads BRIA_API_TOKEN
client = BriaSyncClient(api_token="<token>")      # or pass it explicitly
```

JavaScript / TypeScript
```javascript
const response = await fetch("https://engine.prod.bria-api.com/v2/status/<request_id>", {
  headers: { api_token: process.env.BRIA_API_TOKEN ?? "" },
});
```

cURL
```bash
curl https://engine.prod.bria-api.com/v2/status/<request_id> -H "api_token: $BRIA_API_TOKEN"
```

Bria's integrations read the token from the environment:

| Integration | Where the token goes |
|  --- | --- |
| [Python SDK](/integration-methods/python-sdk) | `BRIA_API_TOKEN` environment variable, or `BriaSyncClient(api_token=...)` |
| REST API (JavaScript, TypeScript, cURL, any language) | `api_token` header |
| [MCP server (hosted)](/mcp-authentication) | `api_token` header, or an OAuth 2.1 bearer token |
| [MCP server (local)](/mcp-authentication) | `BRIA_API_TOKEN` environment variable |
| [Agent skills](/integration-methods/bria-skill) | `BRIA_API_KEY` environment variable |
| [Streaming Background Removal](/streaming-rmbg) | `api_token` or `oauth` query parameter on the WebSocket URL |


## Endpoints that need no token

The [Visual Verification](/visual-verification-overview) endpoints (`POST /v2/image/verify`, `POST /v2/video/verify`) are public so that anyone, including an end user's browser, can verify Bria provenance.

## Keep tokens secret

- Never embed a token in client-side code, mobile apps or public repositories. Call Bria from your backend, or use the hosted MCP server's OAuth flow when end users need to act with their own Bria accounts.
- Rotate keys from the console if one leaks; existing jobs are not affected.
- Webhook deliveries are signed with a key derived from your API token, so a leaked token would also let someone forge webhook payloads. Rotate it if in doubt. See [Webhooks](/getting-started/async-requests#verify-the-signature).


## Errors

| HTTP status | Meaning |
|  --- | --- |
| `401 Unauthorized` | The `api_token` header is missing or the token is invalid or revoked. |
| `403 Forbidden` | The token is valid but the plan does not include the endpoint or feature (for example an Enterprise-only option). |


See [Rate limits and errors](/getting-started/rate-limits-and-errors) for the full error contract.