Authentication

Every request needs a credential. The API uses API keys; the MCP server accepts either a key or sign-in with your Korzy account.

API keys

Create and revoke keys on your account page. A key is shown once, when you create it. Send it in the Authorization header on every request:

Authorization: Bearer korzy_…

• Never put a key in a URL, query string, client-side code or a public repository.
• Use one key per application or environment, so you can revoke one without affecting the others.
• Revoked keys stop working within seconds.
• Use HTTPS only. If a key is ever sent over plain HTTP, treat it as exposed and revoke it.

Scopes

Choose scopes when you create a key. A request outside a key's scopes returns 403.

Subscription

Keys work while your account has an active subscription. Without one, requests return 402 with "code": "subscription_required" and a link to choose a plan. Nothing is charged for these requests.

Sign-in for agents

MCP clients that support OAuth sign-in open a Korzy sign-in page the first time they connect, then store their own token. No API key is needed. See MCP server.

Failed attempts

Repeated failed authentication from one network is temporarily blocked with 429 and a Retry-After header. Check your key and wait before retrying.