---
title: Authentication
description: One header, one credential — an Incoming Secret created in the console.
---

## Incoming Secrets

Create an **Incoming** secret in the console (**Settings → API Keys**), or through the regular API with `POST /api/v1/secret`. The value has the form `<secretId>.<random>` and is returned **once, on create**. No endpoint can read it back.

If you lose it, regenerate the secret. Regenerating or deleting a secret invalidates the old value immediately.

:::warning
Secrets created before the Public API was released cannot authenticate here. Regenerate them to get a value in the `<secretId>.<random>` format.
:::

## Sending the secret

Send the secret in the `Authorization` header on every call. A `Bearer ` prefix is accepted and equivalent.

```bash
curl "https://next.amfg.ai/engine-service/public-api/v1/ticket-quote" \
  -H "Authorization: <secret>"

curl "https://next.amfg.ai/engine-service/public-api/v1/ticket-quote" \
  -H "Authorization: Bearer <secret>"
```

The App is derived from the secret itself, so there is no separate API key or App id to send.

## IP allowlist

Every Incoming Secret has a non-empty list of allowed IP ranges (`ipAddresses`). Calls from other addresses are rejected. Use `0.0.0.0/0` to allow any address.

## Failures

Every authentication failure returns the same response, whatever the cause: a missing or malformed header, an unknown or revoked secret, or a blocked IP.

```json
401 {"code": 401, "message": "Not Authorized"}
```

The secret's `usedAt` timestamp is updated after each successful call, which helps you spot unused secrets.