# API keys and MCP OAuth

Authorize REST calls with an account API key in `X-Api-Key`. Issued keys start with `lf_live_`. Keep them out of query strings, questions and bug reports. Account identity, revocation and shared-credit membership are checked on each call.

The [quickstart](quickstart.md) supplies an executable header example. REST also accepts the same API key as `Authorization: Bearer`; use one credential method. Duplicate headers or conflicting credentials are rejected. Operator benchmark keys cannot replace account identity for watch, ask or billing management.

## OAuth for Claude and ChatGPT

Add `https://mcp.agentdzialek.pl/mcp` in your client and select OAuth. The client discovers metadata, registers and opens browser consent. Enter your account API key on landfeed's consent page and approve access. The client then sends its OAuth token on MCP requests, never an API key inside a question.

| Method | Path |
| --- | --- |
| GET | /.well-known/oauth-protected-resource/mcp |
| GET | /.well-known/oauth-protected-resource |
| GET | /.well-known/oauth-authorization-server |
| POST | /register |
| GET | /authorize |
| GET, POST | /oauth/consent |
| POST | /token |
| POST | /revoke |


The scope is `landfeed:read`. Authorization uses the authorization-code flow with S256 PKCE, an exact registered redirect URI and the discovered `/mcp` resource. Access tokens last one hour; rotating refresh tokens last 30 days. Used authorization codes and old refresh tokens cannot be replayed. OAuth tokens do not authorize `/v1/ask`; use an account API key there.

Revoking the key or account invalidates linked grants. After a leak, revoke the key through account management, issue a replacement and reconnect clients. Do not publish tokens or callback URLs containing authorization codes.

## Troubleshooting

401 means missing or invalid authentication. 403 means missing account identity or permission. `invalid_redirect_uri` requires the client and server operator to agree on an exact allowed callback; adding a server URL in a client UI does not change server policy. On `invalid_grant`, start authorization again. See the [errors catalogue](../../errors.md) and [client setup](mcp-setup.md).

## Account and keys

Read `/v1/billing/account`, `/v1/account/ledger` and `/v1/account/usage` for the authenticated account. List/create keys at `/v1/account/keys`, revoke a caller-owned key with DELETE `/v1/account/keys/{key_id}`, and rotate with POST `/v1/account/keys/{key_id}/rotate`. Secret values are returned only on creation/rotation; keep them private. All account operations are free; reads are paginated. The operation reference defines cursor and key-management permission rules.