# RunPane API auth

The public RunPane website API doesn't require authentication. Don't send an API key, bearer token, cookie, or private code.

## Public website API

1. Send a request to an operation in the [RunPane OpenAPI document](https://runpane.com/openapi.json).
2. Choose a listed response type with the `Accept` header.
3. Follow the published rate limit headers.
4. Keep questions public and safe.

Don't send secrets, credentials, tokens, personal data, health data, or private source code to Ask Pane.

## Local Pane access

The website API can't control your machine. The `runpane` CLI talks to the Pane daemon on your machine.

1. Run `runpane doctor --json`.
2. Run `runpane agent-context --json`.
3. Approve commands that create or delete things with `--yes`.
4. Keep daemon endpoints and remote connection codes private.

See the [runpane CLI docs](/docs/runpane-cli) and [RunPane MCP daemon docs](/docs/mcp) for the full boundary.