Auth and keys

Partner API keys, daily search caps, and how requests are authenticated.

Every MCP tool and every /v1/* REST call needs a beta partner API key. There is no anonymous test mode.

Sending the key

Authorization: Bearer <partner-key>

MCP also accepts ?key= on the server URL. Prefer the header so the key stays out of logs and shared configs.

Your key is personal to the beta. Don’t commit it, paste it into shared chats, or embed it in a client-side app.

Where the key is issued

Keys are hand-issued for the partner beta and sent in your welcome email. Enter the same key in the console to see today’s search usage.

Daily search cap

search counts against a per-key daily allowance (UTC). When the cap is hit:

Code	Meaning
daily_limit_reached	Today’s searches are used up. Response includes used_today / daily_cap (MCP) or usedToday / dailyCap (REST).
rate_limited	Too many searches from this address. Wait retry_after_seconds.

Non-search tools do not consume the search allowance. Failed searches with invalid_key, unauthorized, invalid_arguments, rate_limited, or daily_limit_reached are not counted.

Need a higher cap? Reply to your welcome email.

Auth errors

Code	HTTP	Meaning	What to do
unauthorized	401	No key on the request	Add Authorization: Bearer <key>
invalid_key	401	Key not recognised	Check the key with the AgentMall team

Console vs MCP vs REST

Surface	Auth
MCP mcp.getagentmall.com	Bearer (or ?key=) on every tool call
REST api.getagentmall.com/v1/*	Bearer on every route except GET /health
Console	Key stays in the browser; calls GET /v1/console/* with Bearer

See Errors for the full code list and Console for the partner UI.