> ## Documentation Index
> Fetch the complete documentation index at: https://docs-preview.webcompute.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate Webcompute CLI, SDK, MCP, REST, and browser-agent runs with Webcompute API keys and env-backed secrets.

Webcompute API keys use the `wc_key_` prefix. Treat them like production credentials.

## CLI and MCP

Save your key once:

```bash theme={null}
web login wc_key_your_key_here
```

The CLI stores the key in the Webcompute config directory. MCP processes launched by the CLI can use the stored key.

You can also use an environment variable:

```bash theme={null}
export WEBCOMPUTE_API_KEY=wc_key_your_key_here
```

## SDK workflows

The SDK reads `WEBCOMPUTE_API_KEY` by default:

```ts theme={null}
import { Web } from "@webcompute/sdk";

const web = new Web();
```

You can also pass the key explicitly:

```ts theme={null}
const web = new Web({
  apiKey: process.env.WEBCOMPUTE_API_KEY,
});
```

Use `WEBCOMPUTE_SERVER_URL` or `new Web({ serverUrl })` only for approved non-default environments. Production defaults to `https://api.webcompute.dev`.

## REST integrations

Send the key as a bearer token:

```bash theme={null}
curl https://api.webcompute.dev/v1/browsers \
  -H "Authorization: Bearer $WEBCOMPUTE_API_KEY"
```

`/health` is public and does not require an API key.

## Secrets for browser-agent runs

Do not put secrets directly in a browsing goal. For CLI agent runs, pass env-backed secrets:

```bash theme={null}
web agent --secret accountEmail=ACCOUNT_EMAIL --allow-domain example.com "Open the account page and summarize the billing status."
```

The model receives a scoped variable description, not the raw value. The harness only makes the value available to approved browser code when the domain scope allows it.