Authentication
SocialToAI authenticates with an API key. Send it in the Authorization header on every call to the API or the MCP server. A key starts with stai_live_, is shown once when you create it, and is stored only as a hash, so it can never be shown again. ChatGPT and Claude on the web and the desktop connect to the MCP server by signing in instead: there is no key to paste.
Where the key goes
| Where | How it is written | HTTP API | MCP |
|---|---|---|---|
Authorization header | Authorization: Bearer <YOUR_API_KEY> | Yes | Yes |
X-API-Key header | X-API-Key: <YOUR_API_KEY> | Yes | Yes |
curl https://api.socialtoai.com/v1/search \ -H "Authorization: Bearer $SOCIALTOAI_KEY" \ -H "Content-Type: application/json" \ -d '{"platform":"reddit","query":"saturn rings"}'X-API-Key works the same way, for clients that cannot set Authorization. Send one of them; if you send several and they differ, the request is refused.
Signing in from ChatGPT and Claude
ChatGPT and Claude on the web and the desktop connect to https://mcp.socialtoai.com/mcp with OAuth: you add the address, press Connect, sign in with the code we email you and press Allow. New here? Signing in creates your account. The app gets a token that lasts an hour and renews itself; no key is copied anywhere. The connection shows up in the console under API keys, named after the app, where you can give it a daily cap or revoke it at once. It is billed and limited like a key.
No route takes a key in the address: a request that tries is refused, and the key should be replaced, because it has been exposed. The MCP page has the steps for each client.
Without a key
Tools (7): Brand buzz, Comment analysis, Account watch, Find creators, Creator profile, Bulk link data, Viral finder. Requests without a key are limited to 60 a minute per network address. Everything that returns data needs a key.
When a key is refused
The answer is HTTP 401 with the code unauthorized, and reason says which case it is. Nothing is charged.
| reason | What the answer says |
|---|---|
missing | The API key is missing, mistyped or does not exist. Nothing was charged. |
invalid | The API key is missing, mistyped or does not exist. Nothing was charged. |
key_in_query | This address does not take a key in the URL. The key is now exposed: revoke it, create a new one and send it in a header. Nothing was charged. |
suspended | This account is suspended. Nothing was charged. |
expired | This key has expired. Nothing was charged. |
revoked | This key was revoked. Nothing was charged. |
If a key leaks
Revoke it in the console and create a new one. A revoked key stops working at once. Keys are not rotated in place: a new key is a new secret.
Last updated: