> ## Documentation Index
> Fetch the complete documentation index at: https://docs.simplefunctions.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, browser session, BYOK exchange credentials, MCP auth — every flavor and how they fit together.

SimpleFunctions has three auth flavors depending on the surface:

| Surface                                        | Auth                     | Header                                                                                     |
| ---------------------------------------------- | ------------------------ | ------------------------------------------------------------------------------------------ |
| Landing public + agent reads                   | Optional for basic reads | `Authorization: Bearer sf_live_...` only when using authenticated overlays or higher tiers |
| Thesis + portfolio + watch APIs                | SimpleFunctions API key  | `Authorization: Bearer sf_live_...`                                                        |
| Web terminal sessions                          | Supabase JWT             | `Authorization: Bearer eyJ...`                                                             |
| Terminal data API (`data.simplefunctions.dev`) | Data API key             | `Authorization: Bearer sft_live_...`                                                       |
| Kalshi exchange                                | BYOK private key         | Local-only (CLI), or AES-256-GCM encrypted upload (autopilot)                              |
| Polymarket exchange                            | BYOK wallet              | Local-only or wallet-connect on web terminal                                               |
| MCP                                            | SimpleFunctions API key  | `Authorization: Bearer sf_live_...`                                                        |

## CLI login

```bash theme={null}
sf login
```

Opens a browser. After authorization, the CLI receives a long-lived API key and writes it to `~/.config/simplefunctions/config.json`.

## Manual API key

Get one at `simplefunctions.dev/dashboard/keys`. Set:

```bash theme={null}
export SF_API_KEY="sf_live_..."
export SF_API_URL="https://simplefunctions.dev"
```

## HTTP

```bash theme={null}
curl -H "Authorization: Bearer $SF_API_KEY" \
  https://simplefunctions.dev/api/portfolio/state
```

## User scoping

Authenticated account and portfolio routes are scoped to the authenticated user. Do not pass `userId` from the client for normal reads — server-side resolution always wins.

## Secrets

The CLI and API never return raw exchange private keys. Key metadata may include presence, id suffixes, or created/rotated timestamps, but never secret material.

## BYOK encryption (cloud autopilot)

`sf portfolio enable` does:

<Steps>
  <Step title="Read local Kalshi PEM">
    From your local `~/.config/simplefunctions/config.json` or environment variable.
  </Step>

  <Step title="Encrypt client-side">
    AES-256-GCM with your SimpleFunctions account-derived key. The plain PEM never leaves the local process.
  </Step>

  <Step title="Upload ciphertext">
    `POST /api/portfolio/secrets`. Server stores ciphertext only.
  </Step>

  <Step title="Decrypt during ticks only">
    Decryption happens inside the cloud tick runner only for the active tick, then the key is erased from process memory.
  </Step>
</Steps>

## See also

<CardGroup cols={2}>
  <Card title="API keys" href="/enterprise/api-keys">
    Scopes and rotation.
  </Card>

  <Card title="Portfolio autopilot" href="/guides/portfolio-autopilot">
    Cloud autopilot setup with BYOK.
  </Card>

  <Card title="Security" href="/enterprise/security">
    Encryption and audit guarantees.
  </Card>
</CardGroup>