---
title: "Authentication | distribution.tech"
description: "Every API and MCP call sends an API key from Developers as a Bearer token. How keys, scopes, mandates and idempotency keys work."
canonical: https://distribution.tech/docs/api/authentication
generator: md-live-route
generated: 2026-10-19T11:02:44.797Z
---

# Authentication | distribution.tech
-   [Getting started](https://distribution.tech/docs)
-   [API reference](https://distribution.tech/docs/api)
-   [MCP and agents](https://distribution.tech/docs/agents)
-   [Changelog](https://distribution.tech/docs/changelog)

Docs

-   Using the API ›

    -   [API reference](https://distribution.tech/docs/api)
    -   [Authentication](https://distribution.tech/docs/api/authentication)
    -   [Scopes](https://distribution.tech/docs/api/scopes)
    -   [Errors](https://distribution.tech/docs/api/errors)

-   Inventory and audience ›

    -   [GET /audience](https://distribution.tech/docs/api/get-audience)
    -   [GET /inventory](https://distribution.tech/docs/api/get-inventory)

-   Creators ›

    -   [GET /creators](https://distribution.tech/docs/api/get-creators)
    -   [GET /creators/{id}](https://distribution.tech/docs/api/get-creators-id)
    -   [POST /creators/{id}/price-request](https://distribution.tech/docs/api/post-creators-id-price-request)

-   Campaigns ›

    -   [GET /campaigns](https://distribution.tech/docs/api/get-campaigns)
    -   [POST /campaigns](https://distribution.tech/docs/api/post-campaigns)
    -   [GET /campaigns/{id}](https://distribution.tech/docs/api/get-campaigns-id)
    -   [PATCH /campaigns/{id}](https://distribution.tech/docs/api/patch-campaigns-id)
    -   [DELETE /campaigns/{id}](https://distribution.tech/docs/api/delete-campaigns-id)
    -   [POST /campaigns/{id}/archive](https://distribution.tech/docs/api/post-campaigns-id-archive)
    -   [POST /campaigns/{id}/creator-guidelines](https://distribution.tech/docs/api/post-campaigns-id-creator-guidelines)

-   Plans ›

    -   [POST /plans/{id}/approve](https://distribution.tech/docs/api/post-plans-id-approve)
    -   [POST /plans/{id}/dates](https://distribution.tech/docs/api/post-plans-id-dates)
    -   [POST /plans/{id}/lines](https://distribution.tech/docs/api/post-plans-id-lines)
    -   [GET /plans/{id}/quote](https://distribution.tech/docs/api/get-plans-id-quote)
    -   [DELETE /plans/{id}/lines/{line\_id}](https://distribution.tech/docs/api/delete-plans-id-lines-line-id)
    -   [POST /plans/{id}/lines/{line\_id}/swap](https://distribution.tech/docs/api/post-plans-id-lines-line-id-swap)

-   Proof and results ›

    -   [GET /evidence](https://distribution.tech/docs/api/get-evidence)
    -   [GET /results](https://distribution.tech/docs/api/get-results)

-   Company context ›

    -   [GET /brain](https://distribution.tech/docs/api/get-brain)

-   Feedback ›

    -   [GET /feedback](https://distribution.tech/docs/api/get-feedback)
    -   [POST /feedback](https://distribution.tech/docs/api/post-feedback)


1.  [distribution](https://distribution.tech/)
2.  / [Docs](https://distribution.tech/docs)
3.  / [API reference](https://distribution.tech/docs/api)
4.  / Authentication

Using the API

# Authentication

Every API and MCP call sends an API key from Developers as a Bearer token. How keys, scopes, mandates and idempotency keys work.

Last updated October 19, 2026

Copy page as markdown [View .md](https://distribution.tech/docs/api/authentication.md)

## Send your key

Every request to `https://app.distribution.tech/api/v1` and to the MCP server at `https://app.distribution.tech/api/mcp` carries an API key:

```bash
curl https://app.distribution.tech/api/v1/campaigns \
  -H "Authorization: Bearer $DISTRIBUTION_API_KEY"
```

A request with no key, an unknown key or a revoked key is refused with `401 unauthorized`. Keys are created, rotated and revoked in your workspace under **Developers**. A key is shown once when it is created; the workspace keeps only its prefix.

## Scopes decide what a key reaches

Each key carries scopes, one per kind of read and two for writes. A call outside the key's scopes is refused with `403 forbidden`, and over MCP the tool is not listed for that key at all. The full list is on [Scopes](https://distribution.tech/docs/api/scopes).

## Mandates decide what a key may spend

A key with `campaigns:write` or `plans:approve` acts only inside the mandate the brand sets on it in Developers: the most a plan may total, a monthly cap, the channels, whether it may sign, an expiry, and the brand terms a person accepted for it. A write outside the mandate is refused before any spend with `403 mandate_refused`, the limit, how much over, and `escalate: true`. Take that to a person at the brand; retrying does not help.

## Idempotency keys make writes safe to retry

Every request that starts, changes or signs a campaign or plan takes an `Idempotency-Key` header (over MCP, an `idempotency_key` argument): 8 to 128 characters of letters, digits, dot, underscore, colon or hyphen. A retry with the same key and the same body returns the first answer and never runs twice. The same key with a different body is refused with `409 idempotency_conflict`, and a retry while the first request is still running answers `409 in_progress` with `Retry-After`.

## Limits

One key makes up to 60 requests in a fixed 60-second window; `RateLimit-Remaining` and `RateLimit-Reset` count it down, and past it the answer is `429 rate_limited` with `Retry-After`. A brand starts up to 3 new campaigns in any 24 hours. Creator reads have their own limits, listed on [GET /creators](https://distribution.tech/docs/api/get-creators).

## Request ids

Every response carries an `x-request-id` header. Send your own (8 to 128 letters, digits or `. _ : -`) and it is echoed back. Quote it when you report a slow or failed call.

A key comes from Developers once your brand is approved. [Connect an agent](https://distribution.tech/distribution#access) to ask for access, then make your first call from the [quickstart](https://distribution.tech/docs/quickstart).

On this page

-   [Send your key](#send-your-key)
-   [Scopes decide what a key reaches](#scopes-decide-what-a-key-reaches)
-   [Mandates decide what a key may spend](#mandates-decide-what-a-key-may-spend)
-   [Idempotency keys make writes safe to retry](#idempotency-keys-make-writes-safe-to-retry)
-   [Limits](#limits)
-   [Request ids](#request-ids)

[![distribution.tech](https://distribution.tech/brand/wordmark-light.svg)![distribution.tech](https://distribution.tech/brand/wordmark.svg)](https://distribution.tech/)

Your agent buys your distribution.

Distribution we run for

-   ClickUp
-   Gushwork
-   Tab

Platform

-   [How it works](https://distribution.tech/how-it-works)
-   [Network](https://distribution.tech/network)
-   [Workspace](https://app.distribution.tech/login)
-   [For your agents](https://distribution.tech/distribution)

Solutions

-   [Product launch](https://distribution.tech/solutions/product-launch)
-   [Funding announcement](https://distribution.tech/solutions/funding-announcement)
-   [Feature release](https://distribution.tech/solutions/feature-release)
-   [For brands](https://distribution.tech/for-brands)
-   [For creators](https://distribution.tech/for-creators)

Resources

-   [Blog](https://distribution.tech/blog)
-   [Launch playbook](https://distribution.tech/playbook)
-   [X creator rates](https://distribution.tech/rates/x-creators)

Company

-   [Customers](https://distribution.tech/customers)
-   [Pricing](https://distribution.tech/pricing)
-   [Changelog](https://distribution.tech/changelog)
-   [Build a distribution plan](https://app.distribution.tech/login)
-   [Join the creator network](https://distribution.tech/for-creators#apply)
-   [Log in](https://app.distribution.tech/login)

Legal

-   [Privacy](https://distribution.tech/privacy)
-   [Terms](https://distribution.tech/terms)

© 2026 distribution.tech [Contact: team@distribution.tech](mailto:team@distribution.tech)Cookie settings

Light Dark System