Authentication

Every request carries a bearer API key. Keys are issued per account and scoped to your tier's lookup budget.

Header

Authorization: Bearer $API_KEY

Rules

Keep the key server-side — a key in browser code is a public key. Rotate by requesting a new key and revoking the old one; both are valid during the overlap window.

Unauthenticated requests return 401. Requests over your monthly budget return 429.

MCP

The MCP server uses the same key, supplied in your client configuration. One tool call = one lookup. Access issues: juan@culinayr.com.