Client authentication

The client REST middleware reads the x-api-key header. Header names are case-insensitive, so the OpenAPI specification displays it as X-API-Key.

curl https://api.agenticscraper.com/api/v1/transactions \
  --header "X-API-Key: $AGENTIC_SCRAPER_API_KEY"

API keys authorize account-scoped operations. Keep them in server-side environment variables or a secret manager. Never place them in browser code or commit them to source control.

All public REST endpoints, including MCP Market submission and provider charge operations, use https://api.agenticscraper.com/api/v1 and accept the account API key through X-API-Key. The MCP protocol service is not an alternate public REST origin.