Skip to main content
Every authenticated endpoint takes an API key as a bearer token:
Create the key in the console under Settings → API keys, or through the API. The same key authenticates the MCP server.

​
What does not need a key

A handful of endpoints are public because they are how an account comes into existence in the first place: registration, e-mail confirmation, sign-in, token refresh, the password-reset pair, and the OAuth entry points. Everything else requires a key.

​
What a missing or bad key gets you

A request with no credentials, an unknown key, a disabled key or an expired one is refused with 401. There is no partial access and no anonymous read: the tool catalogue, the endpoint list and every object behind them all require a valid key.
A key carries your account’s full authority, including spending your balance. Send it in the Authorization header only — never in a query string, where it would be written to logs and browser history.

​
Sessions

The console signs people in with sessions rather than API keys, and those tokens travel in the same Authorization header. See Sign-in and account security if you are building against that flow instead.