# Authentication (/docs/authentication)



## The library is public [#the-library-is-public]

Use cases and bot templates can be read without a key. Sign-in is for sponsor bookings, administration, and optional API key management. MMB charges sponsors; reader upgrades are disabled.

## Optional library keys [#optional-library-keys]

[Sign in](/sign-in) to create a key in [API access](/dashboard?view=keys). A key with `library:read` can read either collection and inspect its own usage. Anonymous keys can also read both collections within their lifetime and rate limits.

* `POST /api/v1/auth/agent` mints an anonymous key and returns a claim token. Save the key when shown.
* `POST /api/v1/auth/claim` accepts `claimToken` and `email` to send a verification code.
* `POST /api/v1/auth/claim/complete` accepts `claimToken`, `email`, and `code`. Claiming preserves the key and enables account quotas.
* `GET /api/v1/usage` requires a bearer key and returns account usage.

## Sponsor and administrator keys [#sponsor-and-administrator-keys]

The [sponsor workspace](/sponsors/manage) creates named, scoped keys. Use only the scopes an integration needs. A key cannot grant scopes it does not have; admin scopes also require current admin membership. See the [scope table](/docs/sponsorships#start-with-the-right-access).

```bash
curl "$MMB_BASE_URL/api/v1/sponsors/me" \
  -H "Authorization: Bearer $MMB_API_KEY"
```

Cookie-authenticated changes require the same origin. Bearer-authenticated requests work without a browser. Revocation takes effect immediately.

## Legacy upgrade routes [#legacy-upgrade-routes]

Starting a reader upgrade now returns `409 library_is_free`. Existing payment settlement and receipt handling remain available for historical records. New payments belong to sponsor bookings.