# Authentication

SocialToAI authenticates with an API key. Send it in the Authorization header on every call to the API or the MCP server. A key starts with stai_live_, is shown once when you create it, and is stored only as a hash, so it can never be shown again. ChatGPT and Claude on the web and the desktop connect to the MCP server by signing in instead: there is no key to paste.

- Page: https://socialtoai.com/docs/authentication/
- Last updated: 2026-10-17

## Where the key goes

| Where | How it is written | HTTP API | MCP |
| --- | --- | --- | --- |
| `Authorization` header | `Authorization: Bearer <YOUR_API_KEY>` | Yes | Yes |
| `X-API-Key` header | `X-API-Key: <YOUR_API_KEY>` | Yes | Yes |

**cURL**

```
curl https://api.socialtoai.com/v1/search \
  -H "Authorization: Bearer $SOCIALTOAI_KEY" \
  -H "Content-Type: application/json" \
  -d '{"platform":"reddit","query":"saturn rings"}'
```

`X-API-Key` works the same way, for clients that cannot set `Authorization`. Send one of them; if you send several and they differ, the request is refused.

## Signing in from ChatGPT and Claude

ChatGPT and Claude on the web and the desktop connect to `https://mcp.socialtoai.com/mcp` with OAuth: you add the address, press Connect, sign in with the code we email you and press Allow. New here? Signing in creates your account. The app gets a token that lasts an hour and renews itself; no key is copied anywhere. The connection shows up in the console under API keys, named after the app, where you can give it a daily cap or revoke it at once. It is billed and limited like a key.

No route takes a key in the address: a request that tries is refused, and the key should be replaced, because it has been exposed. [The MCP page](https://socialtoai.com/mcp.md) has the steps for each client.

## Without a key

Tools (7): Brand buzz, Comment analysis, Account watch, Find creators, Creator profile, Bulk link data, Viral finder. Requests without a key are limited to 60 a minute per network address. Everything that returns data needs a key.

## When a key is refused

The answer is HTTP 401 with the code `unauthorized`, and `reason` says which case it is. Nothing is charged.

| reason | What the answer says |
| --- | --- |
| `missing` | The API key is missing, mistyped or does not exist. Nothing was charged. |
| `invalid` | The API key is missing, mistyped or does not exist. Nothing was charged. |
| `key_in_query` | This address does not take a key in the URL. The key is now exposed: revoke it, create a new one and send it in a header. Nothing was charged. |
| `suspended` | This account is suspended. Nothing was charged. |
| `expired` | This key has expired. Nothing was charged. |
| `revoked` | This key was revoked. Nothing was charged. |

## If a key leaks

Revoke it in the console and create a new one. A revoked key stops working at once. Keys are not rotated in place: a new key is a new secret.