> ## Documentation Index
> Fetch the complete documentation index at: https://docs.etho.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Personal API tokens for the public Ad Copy REST API

Send exactly one header:

```
Authorization: Bearer oly_...
```

Mint the token in Settings, API keys. It is bound to one workspace. Olympus stores a hash, not the secret.

Rules:

* Only personal tokens work on REST v1. New keys start with `oly_`; keys created before Oct 2026 start with `olp_` and keep working until you revoke them.
* `ola_` and `olr_` MCP OAuth tokens return `401` with `WWW-Authenticate: Bearer`.
* Cookies and query credentials are ignored and cannot authenticate.
* Every request rechecks membership, billing freeze, and role.
* Creating a job needs `CREATE_CONTENT` (Owner, Admin, Standard). Reading jobs and offers needs `VIEW_CONTENT` (including Viewer).
* Duplicate `Authorization` headers are rejected.

Missing or invalid credentials use problem type `invalid_auth` (`401`). A frozen workspace uses `workspace_frozen` (`403`). A Viewer creating a job uses `forbidden` (`403`).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.