API keys and MCP OAuth
Authorize REST calls with an account API key in X-Api-Key. Issued keys start with lf_live_. Keep them out of query strings, questions and bug reports. Account identity, revocation and shared-credit membership are checked on each call.
The quickstart supplies an executable header example. REST also accepts the same API key as Authorization: Bearer; use one credential method. Duplicate headers or conflicting credentials are rejected. Operator benchmark keys cannot replace account identity for watch, ask or billing management.
OAuth for Claude and ChatGPT
Add https://mcp.agentdzialek.pl/mcp in your client and select OAuth. The client discovers metadata, registers and opens browser consent. Enter your account API key on landfeed's consent page and approve access. The client then sends its OAuth token on MCP requests, never an API key inside a question.
| Method | Path |
|---|---|
| GET | /.well-known/oauth-protected-resource/mcp |
| GET | /.well-known/oauth-protected-resource |
| GET | /.well-known/oauth-authorization-server |
| POST | /register |
| GET | /authorize |
| GET, POST | /oauth/consent |
| POST | /token |
| POST | /revoke |
The scope is landfeed:read. Authorization uses the authorization-code flow with S256 PKCE, an exact registered redirect URI and the discovered /mcp resource. Access tokens last one hour; rotating refresh tokens last 30 days. Used authorization codes and old refresh tokens cannot be replayed. OAuth tokens do not authorize /v1/ask; use an account API key there.
Revoking the key or account invalidates linked grants. After a leak, revoke the key through account management, issue a replacement and reconnect clients. Do not publish tokens or callback URLs containing authorization codes.
Troubleshooting
401 means missing or invalid authentication. 403 means missing account identity or permission. invalid_redirect_uri requires the client and server operator to agree on an exact allowed callback; adding a server URL in a client UI does not change server policy. On invalid_grant, start authorization again. See the errors catalogue and client setup.
Account and keys
Read /v1/billing/account, /v1/account/ledger and /v1/account/usage for the authenticated account. List/create keys at /v1/account/keys, revoke a caller-owned key with DELETE /v1/account/keys/{key_id}, and rotate with POST /v1/account/keys/{key_id}/rotate. Secret values are returned only on creation/rotation; keep them private. All account operations are free; reads are paginated. The operation reference defines cursor and key-management permission rules.