Authentication

Send your key in the Authorization header of every request:

Authorization: Bearer elv_your_key

A missing or invalid key returns 401 UNAUTHORIZED.

One key per store. The key decides which store you read, so you never pass a store ID and can never read another store's data. It only works for the External API: your MCP keys are separate.

Managing it

In Settings → MCP & API:

• Regenerate creates a new key. The old one stops working immediately.

• Revoke deletes the key. Every integration using it is disconnected.

Anyone with the key can read your experiment data. Keep it out of public code, and regenerate it if it leaks.