# API Documentation

## Authentication and Authorization
Authentication and authorization contract: required headers, project isolation, endpoint scopes, and key behavior across read/write/execute surfaces.

### API Keys
All requests require a Mnexium API key. You can pass it via `x-mnexium-key` (recommended) or `Authorization` header.

| Header | Description |
| --- | --- |
| `x-mnexium-key` | `mnx_live_...` — Your Mnexium API key (recommended for SDK users) |
| `Authorization` | `Bearer mnx_live_...` — Alternative: Mnexium key via Authorization header |
| `x-openai-key` | `sk-...` — Your OpenAI API key (required for OpenAI models) |
| `x-anthropic-key` | `sk-ant-...` — Your Anthropic API key (required for Claude models) |
| `x-google-key` | `AI...` — Your Google API key (required for Gemini models) |

**SDK users:** Use `x-mnexium-key` so the SDK's `apiKey` can be used for your provider key (OpenAI, Anthropic, Google). If you override `Authorization` with your Mnexium key, you must explicitly pass the provider key via `x-openai-key`, `x-anthropic-key`, or `x-google-key`.

### API Key Permissions
API keys can be scoped to limit access. Available scopes:

| Scope | GET | POST/PATCH | DELETE |
| --- | --- | --- | --- |
| `read` | ✓ | ✗ | ✗ |
| `write` | ✗ | ✓ | ✗ |
| `delete` | ✗ | ✗ | ✓ |
| `*` | ✓ | ✓ | ✓ |