Authentication and Ownership

HTTP API keys

All data and management endpoints accept either:

X-API-Key: your_key

or ?api_key=your_key. Prefer the header: query-string keys can appear in browser history, access logs, analytics, and copied URLs. The query form remains available for compatibility.

GET /v1/apis and GET /v1/apis/{id} are public and IP-rate-limited.

MCP

POST /mcp accepts either:

Authorization: Bearer your_api_key

or X-API-Key. A deployment may also enable Clerk OAuth for MCP clients. OAuth applies only to /mcp; REST endpoints under /v1/* remain API-key authenticated.

Ownership

Parsers, jobs, batches, databases, crons, workflows, and workflow runs belong to the account resolved from the credential. Requests for another account’s resource return 404, not 403. This avoids revealing whether an identifier exists.

Never infer that a 404 means the identifier is globally absent: it may exist but be inaccessible to the current account.

Browser clients

The API’s production CORS policy is intentionally narrow. Server-side clients and curl support the full HTTP surface. Do not assume arbitrary browser origins can perform parser/database/cron/workflow PUT or DELETE requests.