Authentication

Every request to the API (and to the MCP server) is authenticated with a Bearer API key scoped to your organization:

curl -H "Authorization: Bearer mk_live_..." "$MENTIONS_API_URL/v1/keywords"

Only two endpoints are public: GET /v1/health and the OpenAPI spec at GET /v1/openapi.json.

Keys

• Keys look like mk_live_... and are shown once at creation. Store them immediately; they cannot be retrieved later.
• The API stores only a SHA-256 hash of the key. Lookups are cached for performance.
• A key belongs to one organization; all keywords, mentions, and settings it touches are scoped to that org.

Managing keys

See the API Keys reference for schemas.

Failed authentication

Missing or invalid keys return 401 with the standard error envelope:

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid API key"
  }
}