Auth and keys

Every MCP tool and every /v1/* REST call needs an organization API key. There is no anonymous test mode.

Sending the key

Authorization: Bearer <api-key>

MCP also accepts ?key= on the server URL. Prefer the header so the key stays out of logs and shared configs. Your key belongs to your organization. Don’t commit it, paste it into shared chats, or embed it in a client-side app.

Where the key is issued

Mint a key in the console, or use the one from your welcome email. The same page shows today’s search usage.

Request rate

Each key can make 15 requests a second, across MCP and REST together. Every MCP message and every REST call counts, not only searches. The next request gets HTTP 429 with a Retry-After header and error code rate_limited and retry_after_seconds, the same on MCP and REST. Need more? Reply to your welcome email.

Daily search cap

search_catalog counts against a per-key daily allowance (UTC). When the cap is hit:

Code	Meaning
`daily_limit_reached`	Today’s searches are used up. Response includes `used_today` / `daily_cap` (MCP) or `usedToday` / `dailyCap` (REST).
`rate_limited`	Too many requests: over 15 a second for a key, or too many searches from an address without one. Wait `retry_after_seconds`.

Non-search tools do not consume the search allowance. Failed searches with invalid_key, unauthorized, invalid_arguments, rate_limited, or daily_limit_reached are not counted. Need a higher cap? Reply to your welcome email.

Auth errors

Code	HTTP	Meaning	What to do
`unauthorized`	401	No key on the request	Add `Authorization: Bearer <key>`
`invalid_key`	401	Key not recognised	Check the key with the AgentMall team

The 401 body carries a message that says which case you hit:

{ "error": { "code": "unauthorized", "message": "API key required. Send Authorization: Bearer <key>." } }
{ "error": { "code": "invalid_key", "message": "API key not recognised. Check the key, or ask the AgentMall team for a beta key." } }

A key that was sent but is wrong, revoked or mistyped is always invalid_key, never unauthorized.

Console vs MCP vs REST

Surface	Auth
MCP `mcp.getagentmall.com`	Bearer (or `?key=`) on every tool call
REST `api.getagentmall.com/v1/*`	Bearer on every route except `GET /health`
Console	Sign-in session. Pages read that organization’s rows.

Tool errors are on MCP tools. The organization UI is the console.

Getting Started

Reference

Changelog