> The full uetr.ai documentation index is at https://uetr.ai/llms.txt, and every page under https://uetr.ai/docs/api is also Markdown at its address plus `.md`.

# Authentication

## API keys

Create keys on the [AI and API](https://uetr.ai/connect) page of uetr.ai. A key acts for the user who created it, on the account they are on, with their team rights, and has one of two access levels:

- Read: every read the user can make on the website.
- Read and write: also every change the user can make there, such as adding, renaming, archiving or restoring transfers.

Some operations are the account owner's alone, as on the website. Their pages say so, and a teammate's keys cannot call them. Keys work on every plan, a free account included, within the plan's limits.

Send the key only in the `Authorization` header:

```sh
curl "https://uetr.ai/api/v1/account" \
  -H "Authorization: Bearer $UETR_API_KEY"
```

A key found in a web address, in its path or its query, is revoked at once and the call is refused with `credential_in_url`. Keep keys out of source code and logs.

## Rotating and revoking a key

To rotate a key, create a new one, move your systems to it, then revoke the old one on the AI and API page. A revoked key stops working at once, and calls with it answer `invalid_credential`. When you revoke a key you can also remove what it set up that is still waiting for the account owner, and replace payment record links it shared. While the payment for a team account is overdue, its teammates' keys are paused and answer `credential_suspended`. When an account is deleted, every key is revoked.

## AI apps

Claude, ChatGPT and other AI apps connect to `https://uetr.ai/mcp` and sign in through `https://auth.uetr.ai` with OAuth 2.1 and PKCE: the person approves the app on uetr.ai, choosing read or read and write access, and the app receives its own tokens. An access token lasts one hour and the app renews it; a connection unused for 30 days signs in again. Disconnect an app at any time on the AI and API page. Setup steps for each app are on [uetr.ai/mcp](https://uetr.ai/mcp). A script or an agent framework without a browser can instead send an API key to `https://uetr.ai/mcp`, in the `Authorization` header as for this API.

## Versions

Versions are dates. A key keeps the version it was created on, and a call to this API or to `https://uetr.ai/mcp` can name another known version in the `uetr-version` header; an unknown version is refused with `unsupported_version`. The current version is `2026-10-14`. See the [changelog](/docs/api/changelog).