<!-- https://pricto.dev/docs/autenticacion · Spanish version: https://pricto.dev/docs/autenticacion.md -->

# Authentication

Every API and MCP call is authenticated with an API key in the `Authorization` header. The same key works for REST, MCP and the CLI.

## Key types

| Key | Whose | Data | Charges | Today |
|---|---|---|---|---|
| `sk_test_sandbox` | Public, shared | Sample | No | Available |
| `sk_test_...` | Your account | Sample, fixed | No | With sign-up |
| `sk_live_...` | Your account | Real | Yes, in credits | With sign-up |

Sign-up is not open yet: today only the sandbox exists. Whatever you build with it works the same with a key from your account.

## Header

```http
Authorization: Bearer sk_test_sandbox
```

The key always goes in the header, never in the URL. With no key, or a key that doesn't exist, the API answers `401`:

```json
{
  "type": "https://pricto.dev/docs#unauthorized",
  "title": "API key ausente o inválida",
  "status": 401,
  "code": "unauthorized",
  "detail": "Falta la API key.",
  "hint": "Envía el header 'Authorization: Bearer <api_key>'. Para probar con datos de ejemplo usa la key pública sk_test_sandbox.",
  "request_id": "req_421eba4eb1a7494caa28",
  "docs_url": "https://pricto.dev/docs#unauthorized"
}
```

Without a key you can read `/v1/status`, `/v1/openapi.yaml`, `/llms.txt` and these docs.

## Storing and rotating keys

- Keep it in an environment variable (`PRICTO_API_KEY`) or your platform's secret manager. Don't put it in code that runs in the browser or in a repository.
- Use one key per application or environment: if one leaks, you revoke only that one.
- To rotate: create a new key, deploy it, check your application uses it and revoke the old one. Creating and revoking keys happens in the console, which opens with sign-up.
- Each plan includes a number of keys: 1 on Free, 3 on Builder, 10 on Pro, 25 on Business and 100 on Scale.

## MCP and OAuth

- `https://pricto.dev/mcp/sandbox`: no login, sample data.
- `https://pricto.dev/mcp`: with your key in `Authorization: Bearer`, like the API. Claude Code, Cursor, VS Code and Claude custom connectors accept that header.
- OAuth: the MCP server already publishes its protected resource metadata (RFC 9728) at `/.well-known/oauth-protected-resource/mcp`, but the authorization server isn't active yet. When it is, Claude and ChatGPT will connect with your account without copying a key. There's no date yet; we'll announce it in the [updates](/novedades.xml).