> ## Documentation Index
> Fetch the complete documentation index at: https://agentmall.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Auth and keys

> Organization API keys, daily search caps, and how requests are authenticated.

Every MCP tool and every `/v1/*` REST call needs an organization API key. There is no anonymous test mode.

## Sending the key

```http theme={null}
Authorization: Bearer <api-key>
```

MCP also accepts `?key=` on the server URL. Prefer the header so the key stays out of logs and shared configs.

Your key belongs to your organization. Don't commit it, paste it into shared chats, or embed it in a client-side app.

## Where the key is issued

Mint a key in the [console](https://console.getagentmall.com/keys), or use the one from your welcome email. The same page shows today's search usage.

## Request rate

Each key can make 15 requests a second, across MCP and REST together. Every MCP message and every REST call counts, not only searches. The next request gets HTTP 429 with a `Retry-After` header and error code `rate_limited` and `retry_after_seconds`, the same on MCP and REST. Need more? Reply to your welcome email.

## Daily search cap

`search_catalog` counts against a per-key daily allowance (UTC). When the cap is hit:

| Code | Meaning |
| - | - |
| `daily_limit_reached` | Today's searches are used up. Response includes `used_today` / `daily_cap` (MCP) or `usedToday` / `dailyCap` (REST). |
| `rate_limited` | Too many requests: over 15 a second for a key, or too many searches from an address without one. Wait `retry_after_seconds`. |

Non-search tools do not consume the search allowance. Failed searches with `invalid_key`, `unauthorized`, `invalid_arguments`, `rate_limited`, or `daily_limit_reached` are not counted.

Need a higher cap? Reply to your welcome email.

## Auth errors

| Code | HTTP | Meaning | What to do |
| - | - | - | - |
| `unauthorized` | 401 | No key on the request | Add `Authorization: Bearer <key>` |
| `invalid_key` | 401 | Key not recognised | Check the key with the AgentMall team |

The 401 body carries a message that says which case you hit:

```json theme={null}
{ "error": { "code": "unauthorized", "message": "API key required. Send Authorization: Bearer <key>." } }
{ "error": { "code": "invalid_key", "message": "API key not recognised. Check the key, or ask the AgentMall team for a beta key." } }
```

A key that was sent but is wrong, revoked or mistyped is always `invalid_key`, never `unauthorized`.

## Console vs MCP vs REST

| Surface | Auth |
| - | - |
| MCP `mcp.getagentmall.com` | Bearer (or `?key=`) on every tool call |
| REST `api.getagentmall.com/v1/*` | Bearer on every route except `GET /health` |
| Console | Sign-in session. Pages read that organization's rows. |

Tool errors are on [MCP tools](https://agentmall.mintlify.site/mcp/tools.md). The organization UI is the [console](https://agentmall.mintlify.site/console.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.