Authentication

Send your API key on every request, as Authorization: Bearer dxr_… or X-Api-Key: dxr_…. On MCP, set it once as a header of the connection. Keys are created in the cabinet after the email is confirmed, and each agent should get its own so you can revoke one without stopping the others.

A key can call tools and read the account (usage, calls, plan). It cannot create or revoke keys, change the password, start the trial or manage autopay; those need a signed-in cabinet session, so a leaked key cannot take over the account.

Without a key, paid tools are paid per call over x402 (see Credits and paying), and the three free tools need nothing at all.