> ## Documentation Index
> Fetch the complete documentation index at: https://docs.get3rd.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to create, scope, and revoke an Export API key, and what a key can reach.

The Export API authenticates with an API key sent in the `X-API-Key` header.

```bash theme={null}
curl -H "X-API-Key: 3rd_live_..." \
  "https://app.get3rd.com/api/export/v1/brands"
```

<Warning>
  Export keys are a **separate family** from the keys on the MCP → API Keys tab. MCP keys go in an `Authorization: Bearer` header and do not work here; an export key does not work against MCP. See [API keys & MCP](/integrations/api-and-mcp).
</Warning>

## Create a key

<Steps>
  <Step title="Open the key manager">
    In 3RD, go to **Settings → Looker Studio**. Export keys are managed there because the Looker Studio connector was the first thing built on this API — the same keys work for any integration.
  </Step>

  <Step title="Create and label it">
    Click **Create key** and give it a name that says what it is for, such as `Funnel.io – production`. Limit it to specific brands if the integration should not see them all. Set an expiry if you want the key to retire itself.
  </Step>

  <Step title="Copy it once">
    The full key is shown once, in a reveal dialog. Store it in a password manager or your integration's secret store. 3RD keeps only a SHA-256 hash and cannot show it to you again.
  </Step>
</Steps>

Only an organization **owner or admin** can create, list, or revoke export keys.

Keys look like `3rd_live_` followed by 64 hexadecimal characters.

## What a key can reach

A key reads **every brand in the organization that issued it**, and nothing outside that organization. When you create a key, you can limit it to specific brands instead.

<Warning>
  If you are handing a key to an external partner and your organization holds brands they should not see, limit the key to the brands they may see when you create it. An unrestricted key gives them access to every brand in the organization.
</Warning>

Access is checked on every request against the organization's live state, so:

* Revoking a key takes effect immediately — no cache, no delay.
* An expired key stops working at its expiry time.
* A brand outside the key's organization returns `404`, not `403`.

## Plan limits

| Plan | Keys allowed |
| - | - |
| Lite | 0 — the API is not available |
| Pro | 2 |
| Agency | 5 |
| Enterprise | 20 |

Your plan also caps how far back you can read. See [Pagination and history](/api-reference/pagination).

## Handling keys safely

* Treat a key like a password: never commit it to a repository, paste it into a ticket, or share it in plain text.
* Give each integration its own labelled key, so revoking one does not break the others.
* Rotate periodically: create the new key, switch the integration over, then revoke the old one.
* Lost or leaked a key? Revoke it and create a fresh one.

## Related

* [Export API overview](/api-reference/introduction)
* [Errors and rate limits](/api-reference/errors) — what an unauthenticated request returns


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.