API keys & scopes

Both the REST API and the MCP server authenticate with one thing: an API-key bearer token carrying a set of least-privilege scopes. Mint keys in Settings → API keys.

API-key scopes, from read to writeFour stacked scope chips forming a ladder from projects:read at the bottom up to scans:write at the top, with an upward arrow indicating broader access; the write scope is marked as spending credits.accessprojects:readlist propertiesscans:readread scans & scoresrecommendations:readread recommendationsscans:writestart scans (spends credits)

How scopes resolve

Every route declares a required scope. A request is authorised when its key carries either the coarse legacy scope (e.g. projects:read, scans:write), or a matching fine-grained scope (e.g. scores:read, analytics:read), or the admin superscope. The superscope satisfies every other scope — mint it sparingly.

The scope catalogue

These are the scopes you can attach to a key. Grant only what an integration needs:

  • projects:read / projects:write — Read or manage projects (the property resource).
  • scans:read / scans:write — Read scan results; start, cancel, and analyze scans.
  • scores:read / results:read — Read calibrated scores and engine results.
  • recommendations:read / :write — Read or generate simulated recommendations.
  • competitors:read / :write — Read or manage the competitor set + comparisons.
  • analytics:read — History, movers, anomalies, share-of-voice.
  • reports:read / reports:write — Read or generate scorecards + exports.
  • alerts:read / alerts:write — Read or manage regression/anomaly alerts.
  • billing:read / usage:read — Read credit balance, usage metering, invoices.
  • keys:read / keys:write — Mint and rotate scoped API keys.
  • webhooks:read / webhooks:write — Register and manage webhooks.
  • admin — Superscope — satisfies every other scope. Mint sparingly.

Plan gating

Access is tiered by plan, independent of the scopes on a key:

  • Free — no API or MCP access.
  • Starter — read-only API and MCP; write scopes have no effect.
  • Growth & Enterprise — full read/write API and MCP, plus BYOK (bring-your-own encrypted provider keys).

See Plans & seats for the full plan comparison.

Least-privilege practice

  • Mint one key per integration, scoped to exactly what it calls — never reuse a broad key everywhere.
  • Prefer read scopes (e.g. scores:read) for dashboards and agents that only report.
  • Rotate keys with the keys:write scope; treat a leaked key as compromised and revoke it.
  • Never commit or log a key. Read it from the environment, and let the MCP server pick it up from LOKRIX_API_KEY.

The full scope-to-endpoint mapping lives on the public developer reference.