> ## Documentation Index
> Fetch the complete documentation index at: https://docs.goautofire.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and key lifecycle

> Manage dealership-scoped AutoFire MCP bearer keys safely.

## Who can manage keys

Only the dealership owner or an accepted team administrator can list, create, or revoke MCP keys. Regular team members cannot manage credentials.

## Expiration choices

Every key expires after exactly 30, 60, or 90 days. AutoFire allows at most five active keys per dealership. Use a separate, clearly named key for every client or automation so you can revoke one connection without disrupting another.

## One-time display

The complete key is shown once. AutoFire stores a keyed one-way digest plus a short prefix for identification—not the reusable secret. If you lose a key, revoke it and create a replacement.

## Bearer authentication

Clients must send:

```http theme={null}
Authorization: Bearer $AUTOFIRE_MCP_TOKEN
```

Do not put the literal key in shell history or client configuration when the client supports an environment variable or secret store.

## Rotation

1. Create a replacement key with the same or narrower permissions.
2. Update the client secret.
3. Verify one tool call.
4. Revoke the old key.

## OAuth status

OAuth is not currently enabled for the public AutoFire MCP server. The protected-resource and authorization-server discovery endpoints remain unavailable until AutoFire completes the hosted authorization rollout. Bearer keys continue to be supported independently.