# Choose an authentication method

Separate backend API keys from human website sessions.

## Backend integrations

Partners authenticate with an API key:

```http
Authorization: ApiKey YOUR_API_KEY
```

Use this header on job, file, batch, and account-owned playlist requests. No Discord login, bot token, `Origin` header, or browser cookie is needed for a backend API-key caller.

Keep the key in your service's environment. Your frontend should call your backend, which decides whether the current user may request a download. A shared partner key must not be embedded in a website or mobile application.

A key can have an expiry or be issued without a scheduled expiry. It can still be revoked. Partner keys cannot create, list, or revoke other credentials. Contact [partnerships](mailto:partner@mediafilez.online) for issuance or rotation.

## Website users

The website signs users in through Discord. The API requests identity access, not the user's email. It establishes its own HttpOnly session cookie. Browser calls use credentials:

```javascript
const response = await fetch("https://api.mediafilez.online/api/v1/playlists", {
    credentials: "include"
});
```

Only configured website origins may use credentialed CORS. Session-authenticated writes also require a trusted `Origin`. Adding an API key to browser code is not a fix for a CORS error.

## Ownership

Keys and website sessions belonging to the same API account share ownership and limits. Separate accounts cannot read each other's private jobs or files. Returning `404` for an inaccessible resource is intentional.

A partner account does not automatically become linked to a Discord server or to the Discord accounts of your users.

See the [authentication reference](/docs/en/reference/authentication) for supported session endpoints.