> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enricho.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API-key headers and public REST request limits.

Sign in and open [API keys](https://app.enricho.co/keys), then choose **Create key**; see the [API keys guide](https://docs.enricho.co/api-keys.md). The account app uses `POST https://app.enricho.co/api/account/keys` with `{"name":"My integration"}`, your signed-in session cookie and the required write-request header `X-Requested-With: enricho`, not an existing REST API key. It returns HTTP 201 with `result.id`, `result.name` and `result.key`; copy the secret immediately because it is only shown once. Names must be nonempty after trimming and at most 60 UTF-8 bytes. At most 20 active keys are allowed; attempting another returns 409 until one is revoked. This account-management route is not a REST key-creation endpoint on mcp.enricho.co.

Enricho keys start with `enr_`. The examples use placeholders, not working credentials.

## Bearer header

```bash theme={null}
curl 'https://mcp.enricho.co/api/billing/usage' \
  -H 'Authorization: Bearer enr_YOUR_API_KEY'
```

## Alternative header

```bash theme={null}
curl 'https://mcp.enricho.co/api/billing/usage' \
  -H 'X-Api-Key: enr_YOUR_API_KEY'
```

Use one header, not both. Send requests over HTTPS. Never put keys in URLs, browser bundles, repositories or logs. Revoke and replace exposed keys.

The key identifies the account; a body or query `user_id` cannot select another billing account. Dashboard session cookies are not REST authentication on this host. Missing, malformed, invalid or revoked keys return 401 (`unauthorized`); authentication outages return 503 (`upstream_unavailable`). The [public plan catalog](https://docs.enricho.co/api-reference/plans.md) needs no key.

## Request limits

Default direct REST limits include 60 requests per key per minute and 600 per client IP per minute. Authentication-service defaults also limit each credential to 120 requests/minute and the account to 300/minute across keys and OAuth connected apps. Actual limits depend on deployment settings; extra keys do not bypass account limits. Authenticated calls, including free previews and billing calls, are rate-limited.

A 429 uses `rate_limited`. Wait a minute for request-rate errors, with bounded backoff rather than immediate loops. A daily preview-cap error instead requires waiting until midnight UTC or switching to a paid full search. Do not assume a `Retry-After` header is provided. Preview allowance changes may lag a plan change by up to five minutes.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.