---
title: "Authentication — Retrace"
description: "Retrace authentication guide for API keys, bearer tokens, SDKs, CLI device login, and the hosted MCP server."
canonical: "https://retraceai.tech/developers/authentication"
last-updated: 2026-08-26
format: text/markdown
---

# Authentication

Use a Retrace API key for agents, SDKs, CLI sessions, and server-to-server automation, or a short-lived bearer JWT for the web application.

## What it does

- **API keys for agents** — Create an rt_ API key in the dashboard and send it as x-retrace-key to REST endpoints or as a Bearer token to the MCP server.
- **JWTs for the web app** — The web application uses short-lived Better Auth JWTs verified through asymmetric JWKS; custom integrations should prefer API keys.
- **Keys are shown once** — Copy a new API key when it is created. Retrace stores only a protected hash and cannot display the raw value again.
- **Scoped account access** — Every authenticated read and write is scoped to the account or an authorized organization resource.

## Examples

Authenticate a REST request with an API key.

```terminal
curl https://api.retraceai.tech/api/v1/traces \
  -H "x-retrace-key: rt_..."
```

The MCP endpoint uses the HTTP Authorization header.

```mcp.json
{
  "url": "https://api.retraceai.tech/mcp",
  "headers": { "Authorization": "Bearer rt_..." }
}
```


## Authentication methods

- `x-retrace-key: rt_... — REST API and OTLP authentication`
- `Authorization: Bearer rt_... — MCP and supported REST authentication`
- `retrace auth login — interactive CLI device login`

## Related

- HTML page: https://retraceai.tech/developers/authentication
- Documentation: https://docs.retraceai.tech
- OpenAPI specification: https://retraceai.tech/openapi.json
- Authentication for agents: https://retraceai.tech/auth.md