> ## Documentation Index
> Fetch the complete documentation index at: https://pocketmusala.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication And API Keys

> How PocketMusala Developer API keys are created, stored, rotated, and revoked.

External servers authenticate with a PocketMusala Developer API key:

```text theme={null}
Authorization: Bearer <api_key>
```

Raw keys include a non-secret visible prefix and a secret value:

```text theme={null}
<visible_prefix>_<secret>
```

Only send keys in the `Authorization` header. Do not place keys in URLs, query
parameters, browser code, mobile apps, crash reports, analytics, or logs.

## Key Creation

API keys are created only in the authenticated PocketMusala Developer API
portal. A mosque owner or permitted mosque manager signs in with their existing
PocketMusala account, selects a mosque they can manage, chooses scopes, and
creates a key for an external server.

The public REST API does not expose key creation or permission-management
endpoints.

## Visibility And Storage

PocketMusala shows the raw key during creation and rotation. Copy it into a
server-side secret manager immediately.

Use one key per external system. Do not share one key between unrelated apps or
vendors. Use the key prefix to identify which integration is making requests
without exposing the secret portion of the key.

## Scopes

| Scope        | Meaning                                                                                       |
| ------------ | --------------------------------------------------------------------------------------------- |
| `sync:read`  | Read the mosque sync snapshot, profile, announcements, prayer rows, events, and capabilities. |
| `sync:write` | Create or update approved mosque sync resources. Includes read access.                        |

PocketMusala rejects requests when the key is valid but lacks the required
scope.

## Rotation

Rotate a key from the PocketMusala portal when a secret may have been exposed
or when a server migration needs a fresh credential. Rotation returns a new raw
key. The old key stops working immediately once it is rotated.

Update the external server secret and run the quickstart verification requests
again.

## Revocation

Revoke a key from the PocketMusala portal when an integration is no longer in
use or when immediate shutdown is required. Revoked keys return authentication
errors and cannot be used for future syncs.

Historical sync status remains visible in the portal for troubleshooting.