# Keep access private.

Your server uses a bearer API key. The MovePacket workspace uses browser sign-in. Both grant access to a workspace's activities; an activity ID alone grants no access.

Workspace authentication does not establish athlete consent or athlete-level permission. Athlete invitations, coach–athlete relationships and scoped app grants are planned. See [athlete connections](/docs/connections) and [shared responsibility](/docs/records#shared-responsibility).

## Server requests

Include an `Authorization` header on every `/v1/` request, including downloads.

```sh
curl --fail-with-body "$MOVEPACKET_API_URL/v1/activities" \
  -H "Authorization: Bearer $MOVEPACKET_API_KEY"
```

Store the key in a secret manager or server environment. Do not put it in frontend bundles, browser storage, query strings, logs, or screenshots. MovePacket stores a hash of the key for verification. A missing, unknown, or revoked key returns `401`.

Beta keys are provisioned individually. Self-service creation, scopes, rotation controls, and team invitations are not available in the dashboard yet. A key currently authorizes all implemented activity operations in its workspace.

## Browser sign-in

Invited users sign into the MovePacket workspace using an email code. The workspace makes same-origin authenticated requests without asking for an API key. This browser session is separate from the server API.

For your own frontend, route API calls through your backend and enforce your application's user permissions there. The beta does not provide public cross-origin browser uploads or a temporary upload URL API.

## Workspace boundaries

Lists and activity lookups are scoped to the key's workspace. An activity belonging to another workspace returns `404`, the same as an unknown ID. Uploading identical bytes in different workspaces creates separate activities.

Original files and decoded JSON require authentication. There are no public file URLs. Preserve these boundaries when caching data or proxying downloads through your own application.

## Local development

The local preview can bypass workspace sign-in only on a loopback hostname with the explicit preview setting. Bearer API requests still require a valid key in the local database. A hosted beta key is not automatically a local key.