# Authentication and accounts

Use a partner key from your backend and keep website sessions separate.

## Partner API keys

```http
Authorization: ApiKey YOUR_API_KEY
```

Ask [partner@mediafilez.online](mailto:partner@mediafilez.online) for API access. Store the issued key in your backend's `MEDIAFILEZ_API_KEY` environment variable and send the header above on authenticated requests.

`GET /users/me` checks the key and returns its API account. No request body or Discord login is needed. A partner key cannot create, list, or revoke credentials.

Never put a key in browser code, a mobile app, a URL, or a public log. Anyone holding it can act as your integration account. If it leaks, contact support for revocation and replacement.

## Expiry and replacement

A key's expiry is agreed when it is issued. A key without a scheduled expiry can still be revoked. A replacement key on the same account shares that account's files, playlists, and limits.

For planned rotation, ask for a replacement, update your backend, confirm it works, and arrange revocation of the old key. If the old key is compromised, arrange revocation immediately.

## Website sign-in

Users of the official website sign in with Discord through the [login page](/login). The website uses a session cookie; users don't need to paste an API key into it.

For your own frontend, call your backend and keep the partner key there. The [authentication guide](/docs/en/guides/authentication) explains this separation.

## Check your account

The response contains account information. Keep it within your service rather than showing it to every end user.

```request
{
    "method": "GET",
    "path": "/users/me"
}
```