> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xentfi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> The two credential types used across XentFi's agent tools — Agent API keys for MCP, WAAS org keys for x402.

Agent tools use **two distinct credential types**, scoped differently on purpose. Using the wrong one against the wrong surface returns `401`.

|                 | Agent API key                                           | WAAS org key                                                                                       |
| --------------- | ------------------------------------------------------- | -------------------------------------------------------------------------------------------------- |
| Used by         | [MCP Tools](/agent/tools-reference) (`@xentfi/mcp-sdk`) | [x402 Facilitator](/agent/x402-reference) (`@xentfi/x402-facilitator-sdk`)                         |
| Scoped to       | One Agent + its Policy                                  | Your organization's WAAS wallet                                                                    |
| Headers         | `agentApiKey`                                           | `apikey`, `orgid` (both required)                                                                  |
| Where to get it | Generated automatically when you create an agent        | Dashboard → **Settings** → API Keys                                                                |
| Who needs it    | Anyone running an MCP client on the agent's behalf      | Only the **resource server** side of an x402 flow — a pure payer needs no XentFi credential at all |

## Agent API key (MCP Tools)

<Steps>
  <Step title="Create an Agent">
    [dashboard.xentfi.com](https://dashboard.xentfi.com) → **Agents → New Agent**.
  </Step>

  <Step title="Attach a Policy">
    Per-transaction/daily/weekly/monthly USD limits, an allowed-recipients list, and optionally allowed hours — enforced server-side on every `xentfi_create_payment` call.
  </Step>

  <Step title="Get the Agent API Key">
    After creating the agent, your **Agent API Key** is generated and displayed once. Copy and store it securely — you won't be able to see it again.
  </Step>
</Steps>

```json theme={null}
{
    "mcpServers": {
        "xentfi": {
            "command": "npx",
            "args": [
                "-y",
                "@xentfi/mcp-sdk"
            ],
            "env": {
                "XENTFI_AGENT_API_KEY": "sk_agent_xxx"
            }
        }
    }
}
```

<Warning>
  An agent API key authorizes payments on behalf of that agent. Store it like any other production secret.
</Warning>

## WAAS org key (x402 Facilitator)

Same organization-level `apiKey`/`orgId` used across the rest of the XentFi platform — see [core Authentication](/api-reference/authentication) for how to generate one from **Settings → API Keys**.

```ts theme={null}
import { X402FacilitatorClient } from "@xentfi/x402-facilitator-sdk";

const facilitator = new X402FacilitatorClient({
  apiKey: process.env.WAAS_API_KEY!,
  orgId: process.env.WAAS_ORG_ID!,
});
```

<Note>
  The facilitator URL and relayer wallet are fixed on the backend — `apiKey`/`orgId` are the only two options the client takes. Header names are lowercase (`apikey`/`orgid`).
</Note>

<Note>
  Only the resource-server side (`verify`/`settle`) needs this credential. A pure **payer** signs offline with `signEip3009Authorization` and needs no XentFi credential at all — see [essentials/x402](/essentials/x402#paying-as-an-agent).
</Note>

## Troubleshooting

<AccordionGroup>
  <Accordion title="401 on an MCP tool call">
    `XENTFI_AGENT_API_KEY` didn't reach the process, or the agent's status is `SUSPENDED`/`REVOKED` (`xentfi_get_agent_info` shows this). See [Error Handling](/agent/errors#authentication-failures).
  </Accordion>

  <Accordion title="401/403 from verify() or settle()">
    Invalid or missing WAAS `apiKey`/`orgId` — double-check against the [dashboard](https://dashboard.xentfi.com), and confirm you're using the lowercase `apikey`/`orgid` header names if calling the facilitator's REST endpoints directly rather than through the SDK.
  </Accordion>
</AccordionGroup>

## Next steps

<CardGroup cols={2}>
  <Card title="Tools Reference" icon="list" href="/agent/tools-reference">
    Every MCP tool.
  </Card>

  <Card title="x402 Reference" icon="code" href="/agent/x402-reference">
    `X402FacilitatorClient` methods and types.
  </Card>
</CardGroup>