Authentication

Your account is how you use E3D Pilot: you sign in, buy credits and ask on the website without an API key. An API key is an optional, advanced credential for CI, scripts and connectors that cannot sign in. The two cannot be swapped: a key never signs in to the dashboard, and a dashboard session never calls the MCP endpoint.

Dashboard sign-in

The dashboard at pilot.e3d.ai accepts either of two ways in. Sign-in sets a session cookie that is HttpOnly, Secure and not readable by scripts.

• Password. Your email and password.
• Email me a code. Enter your email and we send a six-digit code that is valid for 10 minutes. Type it in the same browser you asked from; a code typed in another browser is refused. A new address creates an account without a password, and you can add one later with Forgot your password.

• Sessions end after 12 idle hours or 7 days, whichever comes first, and at most 10 sessions exist per account (the oldest ends first).
• Changing or resetting your password ends your other sessions. You can also end every session from Settings.
• Password changes, ending all sessions and deleting the account ask for your password again if you last confirmed it more than 10 minutes ago.
• Too many failed sign-ins slow further attempts for that email, up to a 60 second wait. See Errors and limits.

API keys (optional)

Connectors and scripts call https://pilot.e3d.ai/mcp with Authorization: Bearer <key>. Keys begin with e3d_pilot_. Create them under Settings, Advanced ("Advanced: API keys for CI and scripts").

• A key secret is shown once, when you create it. The dashboard lists only a short prefix, a name, the creation time, the status, the cap and what it has spent.
• A key holds no credits. It spends your account's credits, so credits you buy are available to every key and to the website.
• Each key has three spending limits you set when you create it and can change later: per run (the most one debate may be allowed to cost), per UTC day (a default applies if you set none) and, optionally, in total over the key's life. Held and settled spend both count, requests that arrive at the same moment cannot pass a limit together, and a request that would pass one is refused with a named code (key_cap_per_run, key_cap_daily, key_cap_total). A leaked or looping key can spend only up to its limits, and never more than your account balance. An account-wide daily ceiling applies to everything the account spends.
• Give each agent or script its own key with limits that suit it; only a signed-in person can create a key, change its limits or revoke it, and an agent cannot raise its own limits.
• Usage and History show whether each debate was charged to "Web" or to a key label, so you can use one key per client or person and revoke one without disturbing the others.
• You can have at most 25 keys. Revoking a key is immediate and cannot be undone; creating a new key is free.
• Treat a key like a password. If it may have leaked, revoke it from API keys at once.

An unknown, revoked or expired key is answered the same way, so the endpoint does not reveal which keys exist.

Forgotten password

Use Forgot password. We email a six-digit code that is valid for 15 minutes and allows five attempts. The response is the same whether or not the email has an account.

Deleting an account

Deleting the account revokes every key, ends every session, and forfeits remaining credits after you confirm. It is refused while a balance is negative, a payment dispute is open, or a request is still running. See Credits and billing.