> ## Documentation Index
> Fetch the complete documentation index at: https://open.manus.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate with the Manus API using API keys or OAuth2 tokens

<sup>Questions or issues? Contact us at [api-support@manus.ai](mailto:api-support@manus.ai).</sup>

The Manus API supports two authentication methods. Every request must include one of the following headers:

| Header | Value | Best for |
| - | - | - |
| `x-manus-api-key` | Your API key | Your own integrations and scripts |
| `Authorization` | `Bearer {access_token}` | Third-party OAuth2 apps acting on behalf of a user |

<Info>
  Some endpoints accept only API keys and OAuth tokens from a `Trusted team client` or `Trusted public client`. Other OAuth clients cannot access these endpoints. Each endpoint page notes the supported authentication methods and required OAuth scopes.
</Info>

## API Key

### Create an API key

<Steps>
  <Step title="Open API settings">
    Go to [Manus Developers settings](https://manus.im/app#settings/developers) in the Manus webapp.
  </Step>

  <Step title="Generate a key">
    Click **Create API Key** and give it a descriptive name (e.g. "production", "dev-testing"). Each account can have up to **50** API keys.
  </Step>

  <Step title="Copy and store securely">
    Copy the key immediately — it will only be shown once. Store it in a secure location such as an environment variable or secrets manager.
  </Step>
</Steps>

<Warning>
  Keep your API keys secure and never share them publicly. Each key provides full access to your Manus account. If a key is compromised, revoke it immediately from the settings page.
</Warning>

<Tip>
  Rate limits apply **per user** (shared across all of your API keys). See [Rate Limits](https://open.manus.ai/docs/v2/rate-limits) for the per-endpoint numbers.
</Tip>

### Use the API key

Include the key in the `x-manus-api-key` header with every request:

<Tabs>
  <Tab title="cURL">
    ```bash theme={null}
    curl -X POST https://api.manus.ai/v2/task.create \
      -H "Content-Type: application/json" \
      -H "x-manus-api-key: $MANUS_API_KEY" \
      -d '{
        "message": {
          "content": "hello"
        }
      }'
    ```
  </Tab>

  <Tab title="Python">
    ```python theme={null}
    import os
    import requests

    response = requests.post(
        "https://api.manus.ai/v2/task.create",
        headers={
            "Content-Type": "application/json",
            "x-manus-api-key": os.environ["MANUS_API_KEY"],
        },
        json={
            "message": {
                "content": "hello"
            }
        },
    )
    print(response.json())
    ```
  </Tab>

  <Tab title="TypeScript">
    ```typescript theme={null}
    const response = await fetch("https://api.manus.ai/v2/task.create", {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
        "x-manus-api-key": process.env.MANUS_API_KEY!,
      },
      body: JSON.stringify({
        message: {
          content: "hello",
        },
      }),
    });

    const data = await response.json();
    console.log(data);
    ```
  </Tab>
</Tabs>

## OAuth2 Bearer Token

For third-party apps that act on behalf of team users, use OAuth2 access tokens. Include the token in the `Authorization` header:

```bash theme={null}
curl https://api.manus.ai/v2/task.list \
  -H "Authorization: Bearer {access_token}"
```

Standard OAuth clients are scoped. Some endpoints require a specific scope, such as `create_task` or `manage_all_tasks`, while others require no OAuth scope. Each endpoint page states its requirement. See the [Open App](https://open.manus.ai/docs/v2/open-app) guide for the complete setup flow, available scopes, and token lifecycle.

To identify the user associated with an API key or OAuth token, call [user.me](https://open.manus.ai/docs/v2/user.me). It returns the user ID. API Key and Trusted client callers also receive the user's display name, email, and avatar. The endpoint is read-only and does not require an additional OAuth scope.

<Info>
  **Team only:** Open App creation and authorization require a Team account. Only users in the same team as the app creator can authorize the app.
</Info>

## Authentication errors

If the key or token is missing, the API returns:

```json theme={null}
{
  "ok": false,
  "request_id": "req_abc123",
  "error": {
    "code": "unauthenticated",
    "message": "missing authentication: require either API Key or Bearer Token"
  }
}
```

Invalid, expired, or revoked credentials also return `unauthenticated`. OAuth clients must use the documented message keywords to distinguish token refresh from reauthorization. See [Authentication errors](https://open.manus.ai/docs/v2/open-app#authentication-errors-http-401).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.