Skip to content
AnswerixAI

Authentication

Authenticate AnswerixAI API and MCP requests with an ans_ API key in the Authorization header, and handle 401, 402, 404, 429 and 500 errors.

Updated

AnswerixAI API authentication uses one scheme for every surface: an ans_ API key sent as a bearer token. The same key works for the REST API (/api/mcp/*), the Metrics API (/api/v1/*) and the MCP server (/api/mcp).

How do I send the API key?

Send the key in the Authorization header with the Bearer scheme. The key isn't accepted in a query string or in any other header.

GET /api/mcp/whoami HTTP/1.1
Host: answerixai.com
Authorization: Bearer ans_YOUR_KEY
Accept: application/json

curl "https://answerixai.com/api/mcp/whoami" \
  -H "Authorization: Bearer ans_YOUR_KEY" \
  -H "Accept: application/json"

Replace https://answerixai.com with the host of the AnswerixAI app you sign in to. It is shown in the MCP endpoint in Settings → API Keys.

A successful whoami call returns the identity the key resolves to, which makes it a good connection test:

{
  "userId": "9b1f0c52-6f1e-4c55-a0a4-3c2f7f1d8e21",
  "email": "[email protected]",
  "organizationId": "3e0a9a4c-2b8d-4f6a-9d1e-7c5b2a4f8e10"
}

How do I get an API key?

Create a key in Settings → API Keys with New key. The full key is shown once, so copy it before closing the dialog. Step-by-step instructions are in API keys.

What can a key access?

A key belongs to the team member who created it and acts on the organization that person currently belongs to. It can read every brand in that organization. A brand, opportunity, audit or suggestion from another organization returns 404, exactly as if it didn't exist.

If the key's owner leaves the organization, the key stops returning that organization's data.

How do I revoke a key?

Click the trash icon next to the key in Settings → API Keys and confirm with Revoke. Revocation is immediate: the next request with that key returns 401 {"error": "Invalid API key"}.

What errors can the API return?

AnswerixAI API errors are JSON objects with an error message and one of six HTTP status codes: 400 for a missing or invalid parameter, 401 for a missing or invalid key, 402 for a reached plan limit, 404 for a resource that doesn't exist or belongs to another organization, 429 for the rate limit, and 500 for an unexpected error.

Status Body When it happens
400 {"error": "brand_id is required"} A required parameter is missing, or a value isn't allowed (for example an unknown opportunity status).
401 {"error": "Missing or malformed API key"} No Authorization: Bearer header, or the token doesn't start with ans_.
401 {"error": "Invalid API key"} The key doesn't exist or has been revoked.
402 {"error": "<message>"} A plan limit is reached, for example the monthly content brief or site audit quota. The message says which.
404 {"error": "Brand not found"} The brand or resource doesn't exist or belongs to another organization. The message names the resource.
429 Rate-limit response More than 250 requests in 15 minutes from one IP address.
500 {"error": "<message>"} An unexpected error while processing the request.

What is the rate limit?

The AnswerixAI API allows 250 requests per 15 minutes per IP address. Above that, requests get 429 Too Many Requests until the window moves on. The response includes a Retry-After header with the number of seconds to wait.

Related

Was this page helpful?