> ## Documentation Index
> Fetch the complete documentation index at: https://developers.apob.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Access and authentication

> Use the correct APOB account and understand how API keys and OAuth connections grant access.

## Prepare your account

Sign in to [APOB](https://app.apob.ai) and confirm that you are using the account
whose models, media, and credits you intend to use. Check the capabilities and
access instructions provided by your integration before starting a workflow.

Authentication identifies the account. It does not grant access to another
account's private assets or remove a workflow's input and credit requirements.

## Choose the supported access method

| Access method | Intended use | What to manage |
| - | - | - |
| API key | Programmatic access through an interface that accepts APOB API keys. | Keep the key private, track its expiration, and revoke it when it is no longer needed. |
| OAuth connection | An MCP client that asks you to sign in and authorize access to APOB. | Verify the account and client before approving access, and revoke unused connections. |

Use the access method documented by your client or integration. API keys and
OAuth access tokens are separate credentials with different acceptance boundaries.

### API keys

An API key belongs to an account. Its complete value is returned once when it is
created; a later listing contains identifying metadata rather than the secret.
Store the key securely when you receive it. If it is lost or exposed, replace it
and revoke the old key.

Keep keys in your server's secret storage. Avoid placing them in browser code,
public repositories, screenshots, or support messages.

### OAuth connections

An OAuth client directs you through a sign-in and consent flow. Review the client
and the APOB account before approving the connection. The connected client then
acts under that account's authorization.

If access expires or the connection is revoked, follow the client's sign-in flow
again. A successful login still requires the account to be active when an operation
runs.

## Check access before generating

* Confirm the connected account and its available credits.
* Use your own private models and media, or references explicitly available to you.
* Check whether automatic credit reload is enabled before paid work.
* Keep credentials out of the workflow's prompts and media.

Continue with [models and elements](/concepts/models-and-elements) or
[prepare your media](/guides/preparing-media).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.