# Authentication

Authenticate public API calls with an API key.

Documentation index: https://webcite.co/llms.txt
Canonical page: https://webcite.co/api-docs/authentication
API origin: https://api.webcite.co
Authentication: x-api-key header. Keep keys on your server.

## Send the key in a header

Use `x-api-key: YOUR_API_KEY` on each public API request. JSON operations also use `Content-Type: application/json`. For file uploads, let your client supply the multipart boundary.

```bash
curl --fail-with-body https://api.webcite.co/api/v1/citations \
  -H "x-api-key: $WEBCITE_API_KEY"
```

## Keep account and API access separate

Create and manage keys in [API Keys](/api-keys). A development key and a production key are not interchangeable. Use the documented origin for the environment that issued your key.

Account, billing, admin, and context routes have separate authentication and availability rules. They are not included in this public API-key reference. Manage subscription settings from your account.

## Authenticate an MCP connector

The hosted MCP endpoint is `https://api.webcite.co/mcp`. Its connector configuration uses an `Authorization: Bearer YOUR_API_KEY` header. Follow the [connect page](/connect) for the client-specific setup.