Authentication: API keys and what needs one
How okdata authenticates: an API key starting with okd_ in a Bearer header, where to get and keep it, what works without one, and what an auth error means.
Every paid request carries one API key. Nothing else is needed: no platform account, cookie or QR login.
The key
- Keys start with
okd_. You make them in the console, under API keys; each is shown once, when it is created. - Send it as a header:
Authorization: Bearer okd_.... The same header works for the HTTP API athttps://api.okdata.onlineand the MCP server athttps://api.okdata.online/mcp. - Keep it in an environment variable, by convention
OKDATA_API_KEY, or in a client's own settings in your home folder. Never put it in code, a repository, a URL or a chat that is shared. - Make one key per app or agent and name it after it. Revoking one in the console then stops that app alone.
export OKDATA_API_KEY="okd_..."
curl -sG "https://api.okdata.online/v1/douyin/trends/list" -H "Authorization: Bearer $OKDATA_API_KEY"
What works without a key
| Request | Key |
|---|---|
GET https://api.okdata.online/v1/catalog, GET https://api.okdata.online/v1/catalog/status |
no |
MCP find, describe and the status from account |
no |
Any endpoint call, MCP call |
yes |
GET https://api.okdata.online/v1/account (balance), GET https://api.okdata.online/v1/calls/{request_id}, MCP account balance |
yes, free |
An agent can therefore find endpoints, read prices and check the service before anyone has a key, and check a key without spending anything.
When the key is refused
A missing, mistyped or revoked key gets 401 unauthorized, with charged: false. Check that the header name is Authorization, that the value starts with Bearer (with the space) and that the key is still active in the console. In an MCP client, find still working while call says unauthorized means the key did not reach us.
Signing in from AI apps
Some apps, such as claude.ai connectors and ChatGPT, connect to MCP servers by signing in rather than with a key. okdata supports that sign-in (OAuth 2.1): you sign in to the console and approve the app, and it gets a key of its own with a spending cap ($5 a month unless you change it). Revoke that key under API keys to disconnect the app. Where the app allows a request header, a key there works as before; the integrations pages say which apps do.
Updated