# Authentication

> The keys that let your code and your AI assistant act on your account, what each one can reach, and how to replace one.

Every section below does the same job: in the dashboard (Guide), from your code (API) or through an AI assistant (MCP).

## Guide — In the dashboard

Source: /docs/authentication

### Your keys [#your-keys]

<ApiKeys />

They are also in the [dashboard](https://admin.happierleads.com) under **Integrations → API**.

| Key | Who has it | What it can reach |
| --- | --- | --- |
| **Master Account API Key** | The account owner | Every website on the account, plus account and billing |
| **Website API Key** | Each website | That one website only |

With a website key, every request runs for that key's own website: a different `websiteId` in the request is replaced by the key's website, not refused. To read or change another website, use that website's key or the master key.

The same keys work for both ways of connecting:

- **REST API**: add `privateKey=YOUR_KEY` to the request. Every feature page has an **API** tab with its endpoints, ready to try.
- **MCP server**: your connection URL in **Integrations → MCP Server** already contains the key (`?token=…`). Assistants that support OAuth can sign in with `https://rest-dash.happierleads.com/mcp` instead; they then act as the person who signed in, with that person’s permissions.

Whatever the key, the server checks every request against the account’s plan and the person’s permissions. A key never unlocks more than the dashboard would.

<Callout type="warn" title="Keep keys secret">
Anyone with a key, or a connection URL that contains one, can use your account. Keep keys on your server or in your assistant’s settings, never in browser code, shared documents or a public repository.
</Callout>

### If a key leaks, rotate it [#if-a-key-leaks-rotate-it]

Open **Integrations → API**, pick the key and click **Rotate Key**. The account owner can also rotate the master key under **Account settings → Advanced**.

Rotating takes effect immediately: the old key stops working for the REST API, and any assistant connected with the old connection URL loses access. Copy the new connection URL from **Integrations → MCP Server** into your assistant, and update any integrations that used the old key.

To disconnect only an assistant that signed in with OAuth, remove the Happierleads connector in that assistant’s settings.

### Website IDs [#website-ids]

Most requests take a `websiteId`: the website the request runs for. Ask your assistant to call `list_websites`, or copy it from your website’s settings in the dashboard. Website IDs are 24-character strings such as `64b7f0a1c2d3e4f5a6b7c8d9` (a made-up example used throughout these docs).

### Find your keys in the dashboard [#find-your-keys-in-the-dashboard]

<DemoFrame guide="integrations-api-keys" to="/integrations/{workspace}?tab=api" />

### Every control on this screen [#every-control-on-this-screen]

Every button, field and switch, with what it does.

<ScreenControls screens={["integrations-api"]} />