Skip to main content
Are you found by AI? has no API keys to create and no API key settings screen. Each surface uses one of four kinds of access:

​
Free scan, no authentication

POST /api/scan is publicly accessible with no credentials. Send a JSON body with the url and the scan runs. Paid plans do not get a key for it, because none is needed.
The free scan is rate-limited per IP each hour, with a fair-use allowance of 15 free scans per browser per day. On very busy days the free scan can reach its daily capacity; leave your email and the scan runs automatically when capacity frees, with the result sent to you.

​
Monitor tokens: MCP and console feeds

Each monitored site has its own token, on the free plan as well as Pro. Your console’s Connect your AI section shows it, and it is also the part after /monitor/ in your console link or any monitoring email link. For MCP, the recommended form is the static endpoint with the token in a header:
x-api-key: YOUR-TOKEN works too. URLs end up in server logs, proxies and browser history, and headers do not. The path form, https://areyoufoundbyai.com/mcp/YOUR-TOKEN, keeps working for clients that only take a URL. The same token opens the console as data:
  • https://areyoufoundbyai.com/monitor/YOUR-TOKEN.json: the whole console as one JSON document
  • https://areyoufoundbyai.com/monitor/YOUR-TOKEN/context.md: the same measurements as Markdown
The public demo, https://areyoufoundbyai.com/mcp/demo, needs no token at all.
A token is effectively a password to your own data: anyone who holds it can read your measurements. Do not commit it to source control, post it publicly or put it in client-side code. Sharing it with your own AI tool, or a teammate you trust, is what it is for.

​
Agency keys: the network catalogue

An agency network page is itself an MCP server. Its link reaches the network catalogue for every site in the network. For staff and clients, issue scoped keys instead: each key reaches only the sites you tick when you create it, can be audited (use count and last use), and can be revoked in one click, effective immediately. To create one, open AI access on your network page, name the key, tick the sites it should reach, and press Copy setup to copy a ready-made handoff message. See Scoped keys for the details. A scoped key is used the same way as a monitor token: in an Authorization: Bearer or x-api-key header against https://areyoufoundbyai.com/mcp, or in the path as https://areyoufoundbyai.com/mcp/YOUR-SCOPED-KEY. It works only on MCP; it is not a key for /api/scan, which needs none.

​
x402: paid per call for agents

POST /api/agent/scan (a deep measurement) and GET /api/agent/sov?kw=<category> (AI share of voice for a category) are paid per call over the x402 payment protocol, in USDC on Base. There is no signup, no key and no subscription. A request without an X-PAYMENT header returns HTTP 402 with the payment requirements. /api/agent/scan is currently a preview.

​
Error responses