Skip to main content
Every request to the MCP server must be authenticated with a Antinuous API key. A key identifies your organization — all tool calls run scoped to that org’s data and connected integrations.

​
API keys

Keys are created and revoked from Settings → API Keys.
  • Keys are prefixed with sg_live_.
  • The full key is shown only once, at creation. Store it securely.
  • Only a short prefix (e.g. sg_live_ab12…) is ever displayed afterward, so you can tell keys apart.
  • Keys don’t expire, but you can revoke any key at any time. Revocation takes effect immediately.
Use a separate key per integration or environment (e.g. one for production, one for local testing). That way you can revoke a single key without disrupting everything else.

​
Sending the key

Send your key on every request using either header:
Most MCP clients have a dedicated field for the URL and a place to add a custom header — use the Authorization: Bearer <key> form there.

​
Unauthorized responses

A missing, malformed, or revoked key returns:
with HTTP status 401 and a WWW-Authenticate: Bearer header.

​
Scope and isolation

  • A key only ever accesses the organization it was created for.
  • Async runs (GTM audits, org audits) are also scoped to the org: polling a run id that belongs to another org returns not found.
  • Which tools return enriched results depends on the integrations connected to your org. Check with list_capabilities.