Every authenticated endpoint takes an API key as a bearer token:
Create the key in the console under Settings → API keys, or through the API. The same key authenticates the MCP server.
What does not need a key
A handful of endpoints are public because they are how an account comes into existence in the first place: registration, e-mail confirmation, sign-in, token refresh, the password-reset pair, and the OAuth entry points. Everything else requires a key.
What a missing or bad key gets you
A request with no credentials, an unknown key, a disabled key or an expired one is refused with 401. There is no partial access and no anonymous read: the tool catalogue, the endpoint list and every object behind them all require a valid key.
A key carries your account’s full authority, including spending your balance. Send it in the Authorization header only — never in a query string, where it would be written to logs and browser history.
Sessions
The console signs people in with sessions rather than API keys, and those tokens travel in the same Authorization header. See Sign-in and account security if you are building against that flow instead. 
