# Authentication: API keys and what needs one

> How okdata authenticates: an API key starting with okd_ in a Bearer header, where to get and keep it, what works without one, and what an auth error means.

Canonical page: https://okdata.online/docs/authentication/

Every paid request carries one API key. Nothing else is needed: no platform account, cookie or QR login.

## The key

- Keys start with `okd_`. You make them in the [console](/console/), under API keys; each is shown once, when it is created.
- Send it as a header: `Authorization: Bearer okd_...`. The same header works for the HTTP API at `https://api.okdata.online` and the MCP server at `https://api.okdata.online/mcp`.
- Keep it in an environment variable, by convention `OKDATA_API_KEY`, or in a client's own settings in your home folder. Never put it in code, a repository, a URL or a chat that is shared.
- Make one key per app or agent and name it after it. Revoking one in the console then stops that app alone.

```bash
export OKDATA_API_KEY="okd_..."
curl -sG "https://api.okdata.online/v1/douyin/trends/list" -H "Authorization: Bearer $OKDATA_API_KEY"
```

## What works without a key

| Request | Key |
| --- | --- |
| `GET https://api.okdata.online/v1/catalog`, `GET https://api.okdata.online/v1/catalog/status` | no |
| MCP `find`, `describe` and the status from `account` | no |
| Any endpoint call, MCP `call` | yes |
| `GET https://api.okdata.online/v1/account` (balance), `GET https://api.okdata.online/v1/calls/{request_id}`, MCP `account` balance | yes, free |

An agent can therefore find endpoints, read prices and check the service before anyone has a key, and check a key without spending anything.

## When the key is refused

A missing, mistyped or revoked key gets `401 unauthorized`, with `charged: false`. Check that the header name is `Authorization`, that the value starts with `Bearer ` (with the space) and that the key is still active in the console. In an MCP client, `find` still working while `call` says `unauthorized` means the key did not reach us.

## Signing in from AI apps

Some apps, such as claude.ai connectors and ChatGPT, connect to MCP servers by signing in rather than with a key. okdata supports that sign-in (OAuth 2.1): you sign in to the console and approve the app, and it gets a key of its own with a spending cap ($5 a month unless you change it). Revoke that key under API keys to disconnect the app. Where the app allows a request header, a key there works as before; the [integrations](/integrations/) pages say which apps do.

Updated 2026-11-12