# Authenticating with DynaPictures

DynaPictures authenticates the REST API and the MCP server with an API key. There is no OAuth flow, so an agent cannot obtain a key on its own: a person with a DynaPictures account has to copy the key and give it to the agent.

## Get a key

1. Sign up at <https://dynapictures.com/b/p/register>. There is a free plan.
2. Open the account page at <https://dynapictures.com/app/account> and copy the API key. The API console of any image template shows it too.

## Use the key

Send the key on every request:

```http
Authorization: Bearer YOUR_API_KEY
```

```shell
curl https://api.dynapictures.com/workspaces \
  -H "Authorization: Bearer YOUR_API_KEY"
```

The MCP server at `https://mcp.dynapictures.com/mcp` takes the same header. Listing its tools needs no key, and calling a tool does.

## What a key can do

A key belongs to one user and carries that user's full access. It is not limited to particular workspaces or actions. Treat it like a password: keep it out of URLs, source code and browser code. If a key may have leaked, ask for a new one at <info@dynapictures.com>.

## Errors

A missing or wrong key returns `401` with a JSON body and a `WWW-Authenticate: Bearer` header:

```json
{ "error": true, "message": "Valid API Key is required" }
```

An expired trial returns `403`, with a message saying what to do next. Without AI credits, `POST /ai/generate` returns `402`.

## Other discovery files

- [API reference](https://dynapictures.com/docs/)
- [OpenAPI description](https://dynapictures.com/openapi.json)
- [llms.txt](https://dynapictures.com/llms.txt)