> ## Documentation Index
> Fetch the complete documentation index at: https://dev.jolts.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> One account-scoped API key for HTTP and MCP.

## Create a key

1. Sign in to the application and complete your account details.
2. An account owner or administrator can create a key on the **API keys** page.
3. Copy the key when it is created. It is shown only once.

Searching requires an **active or trialing subscription**. Creating a key does not activate a plan.
Every key on the same subscription shares its usage limits.

## Send it with every request

```http theme={null}
Authorization: Bearer YOUR_API_KEY
```

Use this header with both the HTTP API and the MCP connection. Do not put the key in a URL.
The application host serves the data API and `/mcp`; the Mintlify host serves documentation.
Copy connection addresses from the application's connection guide rather than guessing a hostname.

<Warning>
  Keep keys in your server environment or your agent client's secret storage. Never put them in browser
  JavaScript, public repositories, screenshots, or a support chat. Revoke a leaked key and create a new one.
</Warning>

## Verify access without running a search

After setting `API_BASE` and `API_KEY` as in the [quickstart](/quickstart):

```bash theme={null}
curl --fail-with-body "$API_BASE/api/usage" \
  -H "Authorization: Bearer $API_KEY"
```

A successful response reports subscription status, consumption, limits, and reservations. This read
is not metered. HTTP `401` means the credential was rejected; `402` means a subscription is required.

MCP initialization and `tools/list` require a valid key but do not require an active subscription.
Successful tool discovery alone does not prove that the account can run searches.

## Safe retries

For HTTP searches, send a unique `Idempotency-Key` header. For MCP searches, supply a `request_key`
argument or that header; the argument takes precedence. Reuse the key only for the same operation
and normalized inputs. Give each pagination request a new key.

MCP currently uses bearer authentication, **not OAuth**. A client that only supports OAuth connections
cannot connect to this data server. See [MCP setup](/mcp).