> ## Documentation Index
> Fetch the complete documentation index at: https://docs.runcomfy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

RunComfy API endpoints use **Bearer token authentication**.

Send your API key in the `Authorization` header:

`Authorization: Bearer <YOUR_API_KEY>`

The same API key works across RunComfy APIs (including **Serverless API (ComfyUI)**, **Serverless API (LoRA)**, and the **Model API**).

***

## Get an API key

1. Sign in to RunComfy.
2. Click your avatar in the top-right.
3. Open **Account** and find **API Token**.

<img src="https://mintcdn.com/inceptionsaiinc/4xcluLsVI-oSofYg/docs-image/profile-button.webp?fit=max&auto=format&n=4xcluLsVI-oSofYg&q=85&s=c8e6c06800d999193db12fdeed700eb2" alt="Alt RunComfy Profile Button" width="1470" height="431" data-path="docs-image/profile-button.webp" />

<img src="https://mintcdn.com/inceptionsaiinc/4xcluLsVI-oSofYg/docs-image/api-token.webp?fit=max&auto=format&n=4xcluLsVI-oSofYg&q=85&s=b223e46928ff66189df7df4f73b7206e" alt="Alt RunComfy API Token" width="1460" height="211" data-path="docs-image/api-token.webp" />

If you **Regenerate** your API key, the old key is revoked immediately—update all integrations and environments accordingly.

***

## Security best practices

* Never expose your API key in client-side environments (browsers, mobile apps, desktop GUIs).
* Route requests through a server-side proxy you control.
* Treat API keys like passwords: rotate if leaked, and limit access to trusted systems.