> ## Documentation Index
> Fetch the complete documentation index at: https://developer.dittowords.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> These are Ditto's developer docs. Ditto is a single source of truth for product copy across design, review, localization, and code.
> The first step on any codebase is a scan: https://developer.dittowords.com/get-started/scan-your-repo.md. That page also covers reviewing the style guide Ditto drafts from the scan. After it, the follow-on guides are Connect Figma files and Set up localization (under /guides/) and Connect the Ditto MCP (the Setup page of the MCP reference).
> Two different MCP servers: the Ditto MCP server at https://api.dittowords.com/v2/mcp gives an agent a workspace's text and style guide rules; the documentation MCP server at https://developer.dittowords.com/mcp searches these docs.
> Prefer logging in with a Ditto account (npx -y @dittowords/cli@latest login; OAuth in MCP clients) over API keys. API keys are for CI and headless clients only.
> Commands are complete as written and use npx -y @dittowords/cli@latest; nothing needs a global install.

# Ditto API authentication

> Create a Ditto API key and pass it in the Authorization header. Covers the token format, key management, and how the CLI and MCP log in instead.

Requests to the Ditto API authenticate with an API key in the `Authorization` header. API keys give programmatic access to all data in your workspace, so keep them secret: never commit them or ship them in client-side code.

## Create an API key

1. In Ditto, open [**Developers**](https://app.dittowords.com/developers). If the page offers to **Enable Developer Integrations**, enable them first. Plans that do not include developer integrations can start a trial from this page.
2. Under **API keys**, click **+ Create API key**.
3. Give the key a name and click **Create**.
4. Copy the key now. It is not shown again after you close the dialog.

Keys are managed from the same page. Creating one key per system (CI, an agent, an integration) makes it easy to rotate or remove one without affecting the others.

## Authenticate a request

Pass the key in the `Authorization` header with the `token` scheme:

```text theme={null}
Authorization: token <your-api-key>
```

Example:

```sh theme={null}
curl "https://api.dittowords.com/v2/projects" \
  --header "Authorization: token <your-api-key>"
```

## The CLI, the MCP server, and agents

API keys are for calling the REST API directly and for CI. The developer-facing tools log in with your Ditto account instead, so no key is needed on a developer's machine:

* The **CLI** logs in through your browser with `npx @dittowords/cli login`. Only a CI job without a browser needs an API key, set as `DITTO_TOKEN`. See [Install and log in](/cli-reference/authentication).
* The **MCP server** logs you in with OAuth the first time a client connects. It accepts `Authorization: token <your-api-key>` for CI and headless clients. See [Connect the Ditto MCP](/guides/connect-the-mcp#api-key-for-ci-and-headless-clients).
* The **Ditto Specs CLI** has no login flow yet and reads `DITTO_TOKEN`. See [Specs CLI setup](/ditto-specs-cli-reference/setup).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.