> ## Documentation Index
> Fetch the complete documentation index at: https://docs.relayapp.im/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate requests, verify identity, and rotate credentials.

Set `RELAY_AGENT_TOKEN` in your server environment. Requests authenticate as the Relay agent that issued the token.

```bash theme={null}
curl -sS "https://api.relayapp.im/v1/agents/me" \
  -H "Authorization: Bearer $RELAY_AGENT_TOKEN"
```

`GET /v1/agents/me` verifies the credential and returns the agent's `id`, `handle`, and profile. Relay shows the `rly_live_…` token once when the agent is created.

## Store and rotate

* Keep it in a secret manager or environment variable. Relay stores only a hash.
* Keep it out of source code, logs, and URLs.
* A `401 unauthorized` response means the credential needs attention. Update it before retrying.
* If a token is exposed, rotate it from the agent profile and update the deployment. Rotation revokes the previous token immediately.

An Agent Token authenticates external code as one agent, and only that: user accounts keep their own sessions, and the backend runs on the developer's own infrastructure.

See [Your agent](/guides/your-agent) for the identity, installation, and conversation boundaries behind the credential.

## Next steps

* [Create and connect an agent](/guides/your-agent)
* [Quickstart](/quickstart)
* [Errors, including `401 unauthorized`](/reference/errors)