# Authentication and Ownership | Parsium Docs

> API-key transports, MCP authentication, and resource ownership behavior.

Source: https://docs.parseium.com/guides/authentication/

# Authentication and Ownership

## HTTP API keys

 Section titled “HTTP API keys”

All data and management endpoints accept either:

```
X-API-Key: your_key
```

or `?api_key=your_key`. Prefer the header: query-string keys can appear in browser history, access logs, analytics, and copied URLs. The query form remains available for compatibility.

`GET /v1/apis` and `GET /v1/apis/{id}` are public and IP-rate-limited.

## MCP

 Section titled “MCP”

`POST /mcp` accepts either:

```
Authorization: Bearer your_api_key
```

or `X-API-Key`. A deployment may also enable Clerk OAuth for MCP clients. OAuth applies only to `/mcp`; REST endpoints under `/v1/*` remain API-key authenticated.

## Ownership

 Section titled “Ownership”

Parsers, jobs, batches, databases, crons, workflows, and workflow runs belong to the account resolved from the credential. Requests for another account’s resource return **404**, not 403. This avoids revealing whether an identifier exists.

Never infer that a 404 means the identifier is globally absent: it may exist but be inaccessible to the current account.

## Browser clients

 Section titled “Browser clients”

The API’s production CORS policy is intentionally narrow. Server-side clients and `curl` support the full HTTP surface. Do not assume arbitrary browser origins can perform parser/database/cron/workflow PUT or DELETE requests.