Skip to main content
AgentKey authenticates with a single master key. The same key authorizes all categories — search, scrape, social, crypto, and more — on both the MCP server and the REST API, and is tied to your subscription.

​
Your master key

Keys look like ak_.... Create and manage them from the console.
Your master key is a secret. Anyone with it can spend your credits. Never commit it to source control, embed it in client-side code, or paste it into a chat.

​
In an agent (MCP)

By default you never handle the key at all. The AgentKey MCP server at https://api.agentkey.app/v1/mcp supports OAuth: the installer registers the server with no credentials and your client opens a browser tab to sign in on first use. Claude Code, Cursor, Claude Desktop, Codex, Gemini CLI and most other MCP clients work this way.
1

Install

Run the one-line installer, a plugin marketplace install, or add the server URL in your client’s MCP settings — see Installation.
2

Sign in

Complete the sign-in prompt your client shows (typically an Authenticate action in its MCP panel, or a browser tab that opens on its own).
3

Pick a plan

Subscribe in the console — see Subscription & Billing.

​
API key fallback

Some clients cannot run MCP OAuth (DeepSeek Harness today, and any client that only takes a static header). For those, create a key in the console and register the same URL with a bearer header. The exact file differs per client, but the entry looks like:
Restart the client afterwards. The AgentKey skill prefers OAuth and only falls back to a key when the client can’t do better.

​
In code (REST)

The REST API has no OAuth flow: create a key in the console and send it as a bearer token on every POST /v2/ops/{method} call. The catalog, describe and OpenAPI endpoints are public and need no key.
A missing or invalid key returns 401 with error_type: "unauthorized". See Scenario Methods → Requests.

​
Storing keys safely

  • Prefer the OAuth sign-in in agents; use a key only where you must. In code, read it from an environment variable or a secret manager, never from source.
  • Use separate keys per environment (development, staging, production) so you can rotate one without disrupting the others.
  • Rotate immediately from the console if a key is ever exposed.