> For the complete documentation index, see [llms.txt](https://docs.elevateab.com/elevate-helpcenter/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.elevateab.com/elevate-helpcenter/developer-reference/external-api/authentication.md).

# Authentication

How to authenticate Elevate A/B Testing External API requests with a store API key, and how to regenerate or revoke that key in Settings.

Send your key in the `Authorization` header of every request:

```http
Authorization: Bearer elv_your_key
```

A missing or invalid key returns `401 UNAUTHORIZED`.

{% hint style="info" %}
**One key per store.** The key decides which store you read, so you never pass a store ID and can never read another store's data. It only works for the External API: your MCP keys are separate.
{% endhint %}

## Managing it

In **Settings → MCP & API**:

* **Regenerate** creates a new key. The old one stops working immediately.
* **Revoke** deletes the key. Every integration using it is disconnected.

{% hint style="warning" %}
Anyone with the key can read your experiment data. Keep it out of public code, and regenerate it if it leaks.
{% endhint %}