> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://developers.brevo.com/docs/authentication-schemes/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developers.brevo.com/_mcp/server.

# Authentication schemes

#### [API Key](/docs/api-key-authentication)

Use a secret token for direct API access.\
\

**When to use?**\

Direct integrations and server-to-server communication where you control both endpoints.

#### [OAuth 2.0](/docs/oauth)

Let users authorize your app, or connect your own backend as a machine-to-machine (M2M) client.\
\

**When to use?**\

Building an app that acts on behalf of a user, or a backend integration calling the API as itself.

## API key authentication

Use API key authentication for direct API access. Include your API key in the `api-key` header for each request.

**Best for:**

* Direct API integrations
* Server-to-server communication
* Testing and development

See [API Key authentication](/docs/api-key-authentication) for setup instructions.

## OAuth 2.0 authentication

Use OAuth 2.0 when your application needs to act on behalf of a Brevo user, or when your backend needs a scoped, short-lived credential instead of a static API key. Create and manage OAuth apps instantly with the Brevo CLI — no form, no manual approval.

**Best for:**

* Apps acting on behalf of a user
* Server-to-server integrations, via machine-to-machine (M2M)
* Private integrations within an organisation

See [OAuth 2.0](/docs/oauth) to get started.

> Choose between API key and OAuth 2.0 authentication for the Brevo API

## Docs

- [API key authentication](https://developers.brevo.com/docs/api-key-authentication.md): Generate and use an API key to authenticate your Brevo API requests
- [OAuth 2.0](https://developers.brevo.com/docs/oauth.md): Token-based authentication — machine-to-machine or on behalf of a user
- [Machine-to-machine (M2M)](https://developers.brevo.com/docs/oauth-m2m-authentication.md): Scoped, short-lived credentials for server-to-server calls — no user, no static key
- [IP security & authorization](https://developers.brevo.com/docs/ip-security.md): Restrict API access to authorized IP addresses