Authentication

Keys look like sk_live_ followed by a 48-character hex secret. Each key works across every site on your account — pick which site each request runs against per call (see Multi-site).

Put the key in the Authorization header of your MCP server config. The client then sends it on every tool call:

{
  "mcpServers": {
    "seo-ladders": {
      "type": "http",
      "url": "https://www.seoladders.com/api/mcp",
      "headers": {
        "Authorization": "Bearer sk_live_••••••••••••••••"
      }
    }
  }
}

Missing or invalid keys return 401 Unauthorized:

{
  "error": "unauthorized",
  "message": "Invalid or missing API key. Pass it as `Authorization: Bearer <api_key>`."
}

When your account has more than one site, name the site you want to work on via either:

• X-Site: acme.com header (recommended)
• a ?site=acme.com query string on the server URL (if both are set, the header wins)

{
  "mcpServers": {
    "seo-ladders": {
      "type": "http",
      "url": "https://www.seoladders.com/api/mcp",
      "headers": {
        "Authorization": "Bearer sk_live_••••••••••••••••",
        "X-Site": "acme.com"
      }
    }
  }
}

The site value is the canonical hostname — we normalize on lookup so https://www.acme.com/ and acme.com resolve the same way. Omit both and your agent works on your active site — whichever one you last switched to in the dashboard sidebar. A bad hostname returns 404 not_found with the normalized value we tried to match.

Generate keys on the Developers page:

1. Sign in to the dashboard and open /dashboard/developers
2. Click Create API key and give it a label (e.g., “CI/CD”, “Local dev”)
3. Copy the key immediately — we show the secret only once
4. Store it in a secrets manager or environment variable (never in source)

Keys can be rotated at any time without downtime. Issue a new key, swap it into your client config, then revoke the old one. The dashboard shows last-used timestamps so you can confirm a key is no longer in use before revoking.

• Rotate proactively on a 90-day cadence for production keys
• Rotate immediately if a key was logged, leaked, or committed to source control
• Use separate keys per machine or client, so a leak from one costs you one

An MCP config file lives in a project or a home directory, and both get committed by accident. Clients that support it read the key from the environment instead:

# Read the key from the environment rather than pasting
# it into a config file you might commit.
SEOLADDERS_API_KEY=sk_live_••••••••••••••••

• In a repo — keep .mcp.json out of version control, or reference an environment variable from it
• On a shared machine — use your own key rather than one the team passes around, so revoking it costs nobody else anything
• In a secrets manager — 1Password CLI, Doppler or Vault, if your team already runs one

The Claude app connects by signing in and needs no key at all. Claude Code, Cursor, Windsurf, Codex and ChatGPT take one in the header shown above, and the MCP server attaches it to every tool call from then on. See MCP + Skill for the full configuration, per client.

Webhooks use a separate signing secret (HMAC-SHA256), distinct from API keys. Each product has one webhook signing secret you can rotate on the Developers page. See Webhooks for verification examples.

Each surface (article generation, keyword research, optimization, and so on) has a per-month quota tied to your subscription tier. When a surface's quota is exhausted, its tools stop and your agent reports back:

{
  "error": "rate_limited",
  "message": "Monthly quota reached for this surface. Upgrade your plan or wait for the reset."
}

Track remaining quota per surface on the Usage & billing page in the dashboard.