# API authentication

> Create a GetIntel API key, send it as a Bearer token, choose the brand with brand_id, and revoke keys you no longer use.

Source: https://getintel.ai/docs/api/authentication/

## API keys

Send your key in the `Authorization` header on every request:

```sh
curl https://app.getintel.ai/api/v1/overview \
  -H "Authorization: Bearer YOUR_API_KEY"
```

Create keys in **Integrations → Developers → GetIntel API**. The full key is shown once, when you create it. After that GetIntel only shows its last 4 characters, when it was created, who created it, and when it was last used.

- **Keys are read-only.** They can't change anything in GetIntel.
- **Keys belong to the account,** not to one person or brand. Anyone on the account can see and revoke them, and a key keeps working if the person who made it leaves.
- **Keys don't expire.** Revoke a key to stop it: it stops working immediately.

API keys only work with the API. They don't work with the [MCP server](/docs/mcp/tokens-and-permissions/) or the [Looker Studio connector](/docs/looker-studio/), and those tokens don't work here.

## Choosing the brand

One key reads every brand on the account. Pass `brand_id` to choose one:

```sh
curl "https://app.getintel.ai/api/v1/topics?brand_id=123" \
  -H "Authorization: Bearer YOUR_API_KEY"
```

- Get brand ids from `GET /brands`.
- If the account has **one** brand, `brand_id` is optional.
- If it has **several**, leaving it out returns `400 brand_required`.
- A `brand_id` that isn't on your account returns `404 brand_not_found`. The API never falls back to another brand.

<Aside type="caution">
Treat API keys like passwords. Keep them on your server or in a secrets manager, never in browser code, a public repository or a shared spreadsheet. If a key leaks, revoke it and create a new one.
</Aside>