# Create an API key (/docs/api/getting-started/api-key)



Every request to the Layers API — and every MCP session — authenticates with a
Bearer key. Here's how to get one.

<Callout type="info">
  Keys are shown **once** at creation. Copy it somewhere safe; you can't read it
  again, only rotate or revoke it.
</Callout>

## Option A — from the dashboard [#option-a--from-the-dashboard]

<Steps>
  <Step>
    Open **Org Settings → API Keys** in the [Layers app](https://app.layers.com).
  </Step>

  <Step>
    Click **Create key**, pick the scopes it needs, and copy the `lp_…` secret.
  </Step>

  <Step>
    Store it as an environment variable:

    ```bash
    export LAYERS_API_KEY=lp_xxxxxxxxxxxxxxxxxxxx
    ```
  </Step>
</Steps>

## Option B — for a customer (sub-organization) [#option-b--for-a-customer-sub-organization]

If you manage customers as sub-organizations, mint a scoped child key with your
parent key — see [`createSubOrgApiKey`](/docs/api/reference/organizations/api-keys/mint).

## Make your first call [#make-your-first-call]

```bash
curl https://api.layers.com/v1/whoami \
  --header "Authorization: Bearer $LAYERS_API_KEY"
```

A `200` with your organization confirms the key works. Next:
[Authentication](/docs/api/getting-started/authentication) ·
[Common patterns](/docs/api/getting-started/common-patterns).