> ## Documentation Index > Fetch the complete documentation index at: https://darwin.so/docs/llms.txt > Use this file to discover all available pages before exploring further. # Developer > Authenticate your application, connect users, and call Navigator and Publish. Every public product API call requires authentication, including Search, Get search request, Act, Assist, and Publish. Use a Darwin API key in `x-api-key`, or an approved OAuth access token in `Authorization: Bearer`. Never put server API keys in a browser, mobile app, or agent conversation. ## 1. Create your application and key [Create and verify your account](https://darwin.so/docs/admin/account.md), then [register an application](https://darwin.so/docs/reference/account-application-create.md) with `POST /api/v2/account/applications`. Your signed-in account session authorizes registration; you do not need an API key before creating your first one. [Create an API key](https://darwin.so/docs/reference/account-api-key-create.md) with `POST /api/v2/account/api-keys` using the same signed-in session. Choose the narrowest scopes. Darwin shows the secret once; store it on your server. An application key with `directory:read` can Search under your application’s identity. It does not identify an end user and cannot authorize private reads, Act, authentication, or payment on a customer’s behalf. ```bash theme={null} curl https://api.darwin.so/api/v3/search \ -H "x-api-key: $DARWIN_API_KEY" \ -H 'Content-Type: application/json' \ --data '{"query":"extract invoice line items as JSON","maxResults":5}' ``` Use the same owner credential for follow-ups and `GET /api/v3/search/{searchId}`. A Search ID or guest Search token alone is not API authentication. Missing, invalid, expired, or revoked credentials return `401`; insufficient scope or ownership returns `403`. ## 2. Choose who authorizes and pays ### Connect your users Send each person through Darwin sign-in and OAuth consent. Your application receives a scoped access token. Users keep their API keys private and bring their own identity, plan, credits, and approvals. Connecting them is free for your application; Search remains ad-supported under the connected-user experience. For Act on a person’s behalf, obtain their account-level `human:actions` grant. A target must also be executable, and provider access, actions, and payments can require separate approval. Consent never guarantees provider completion. ### Run work for your own account Use your own account key with the required scopes for work you own. For Act, use a user key with `directory:read`, `agent:read`, and `agent:write`; the API verifies the selected agent or account authority again. An application Search key cannot perform that work. Your account pays the listed API usage rates. Developer-paid Search requests return results without ads. Do not reuse your own account key or OAuth grant to impersonate customers: it has your authority and spending context. Assist and Publish use API-key authentication with their documented scopes. Keep credentials and any request-specific access tokens private. [API Reference](https://darwin.so/docs/reference/search.md) describes each operation’s accepted credential. ## 3. Preserve ownership and safe retries * Search and Get search request use the same authenticated owner. * Act starts or continues one authorized thread. Preserve `actRequestId`, `threadId`, and exact pending request IDs. * Assist plans, executes, and updates one `assistId`; planning does not start paid work. * Reuse `Idempotency-Key` with identical inputs when retrying a write after an ambiguous response. * On `429`, wait for `Retry-After`, then use bounded backoff with jitter. [Rate limits](https://darwin.so/docs/admin/rate-limits.md#developers) are shared across credentials owned by the same account. Key rotation, OAuth clients, applications, and acting agents do not create new allowances. A workspace subscription does not automatically raise API request limits. ## MCP and website access MCP requires Darwin sign-in and scoped consent before connecting, including Search. OAuth discovery, login, verification, and initial credential setup are bootstrap flows. The website can provide guest browsing through its separate scoped guest session; that session is not a credential for the public developer API. ## Usage and spending Application owners can use the [spending report](https://darwin.so/docs/reference/account-spend.md) and [usage report](https://darwin.so/docs/reference/account-observability-usage.md) with an owner user key carrying `usage:read` and an `applicationId`. Application-only Search keys and customer OAuth grants cannot administer application-wide reports. ```bash theme={null} curl --get https://api.darwin.so/api/v2/account/observability/usage \ -H "x-api-key: $DARWIN_OWNER_API_KEY" \ --data-urlencode "applicationId=$DARWIN_APPLICATION_ID" \ --data-urlencode 'days=7' ``` The application usage metric is `api_request_success`: request counts, successes, failures, unknowns and average latency by operation. An HTTP success is not a verified task outcome. Reports include only recorded application requests; use `coverage` to see source limitations. The spending report excludes customer-funded transactions from the application's payer scope. It reports recorded settled/captured application transactions, or settled execution reservations on the older storage version, with explicit coverage limits. Reserved amounts and wallet funding are not spending. For your own personal AI, omit `applicationId`; for a business you administer, pass `aiId` instead. ## Memory The personalization preview adds [Get memory](https://darwin.so/docs/reference/get-account-memory.md) and [Update memory](https://darwin.so/docs/reference/replace-account-memory.md) under Account. Use the personal, application-user or business-agent scope described in [Personal context](https://darwin.so/docs/navigate/personal-context.md). Memory does not grant execution, authentication or payment permission. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.