> ## Documentation Index
> Fetch the complete documentation index at: https://areyoufoundbyai.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication: what each Are you found by AI? endpoint needs

> What authenticates where: the free /api/scan needs nothing, monitor tokens open MCP and the console feeds, agency keys open the network catalogue, and x402 pays for /api/agent/*.

Are you found by AI? has no API keys to create and no API key settings screen. Each surface uses one of four kinds of access:

| Surface | Access |
| - | - |
| `POST /api/scan` | None. Free, no auth |
| MCP server and console feeds (`/mcp`, `/monitor/<token>.json`, `/monitor/<token>/context.md`) | The monitor's token |
| Agency network catalogue over MCP | Your network link or a per-staff scoped key |
| `POST /api/agent/scan`, `GET /api/agent/sov` | x402 payment per call |

## Free scan, no authentication

`POST /api/scan` is publicly accessible with no credentials. Send a JSON body with the `url` and the scan runs. Paid plans do not get a key for it, because none is needed.

```bash theme={null}
curl -X POST https://areyoufoundbyai.com/api/scan \
  -H 'Content-Type: application/json' \
  -d '{"url": "https://example.com"}'
```

<Note>
  The free scan is rate-limited per IP each hour, with a fair-use allowance of **15 free scans per browser per day**. On very busy days the free scan can reach its daily capacity; leave your email and the scan runs automatically when capacity frees, with the result sent to you.
</Note>

## Monitor tokens: MCP and console feeds

Each monitored site has its own token, on the free plan as well as Pro. Your console's **Connect your AI** section shows it, and it is also the part after `/monitor/` in your console link or any monitoring email link.

For MCP, the recommended form is the static endpoint with the token in a header:

```bash theme={null}
curl -X POST https://areyoufoundbyai.com/mcp \
  -H "authorization: Bearer YOUR-TOKEN" \
  -H "content-type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
```

`x-api-key: YOUR-TOKEN` works too. URLs end up in server logs, proxies and browser history, and headers do not. The path form, `https://areyoufoundbyai.com/mcp/YOUR-TOKEN`, keeps working for clients that only take a URL.

The same token opens the console as data:

* `https://areyoufoundbyai.com/monitor/YOUR-TOKEN.json`: the whole console as one JSON document
* `https://areyoufoundbyai.com/monitor/YOUR-TOKEN/context.md`: the same measurements as Markdown

The public demo, `https://areyoufoundbyai.com/mcp/demo`, needs no token at all.

<Warning>
  A token is effectively a password to your own data: anyone who holds it can read your measurements. Do not commit it to source control, post it publicly or put it in client-side code. Sharing it with your own AI tool, or a teammate you trust, is what it is for.
</Warning>

## Agency keys: the network catalogue

An agency network page is itself an MCP server. Its link reaches the [network catalogue](/docs/mcp/tools#agency-network-catalogue) for every site in the network. For staff and clients, issue **scoped keys** instead: each key reaches only the sites you tick when you create it, can be audited (use count and last use), and can be revoked in one click, effective immediately.

To create one, open **AI access** on your network page, name the key, tick the sites it should reach, and press **Copy setup** to copy a ready-made handoff message. See [Scoped keys](/docs/guides/scoped-keys) for the details.

A scoped key is used the same way as a monitor token: in an `Authorization: Bearer` or `x-api-key` header against `https://areyoufoundbyai.com/mcp`, or in the path as `https://areyoufoundbyai.com/mcp/YOUR-SCOPED-KEY`. It works only on MCP; it is not a key for `/api/scan`, which needs none.

## x402: paid per call for agents

`POST /api/agent/scan` (a deep measurement) and `GET /api/agent/sov?kw=<category>` (AI share of voice for a category) are paid per call over the x402 payment protocol, in USDC on Base. There is no signup, no key and no subscription. A request without an `X-PAYMENT` header returns HTTP 402 with the payment requirements. `/api/agent/scan` is currently a preview.

## Error responses

| HTTP status | Where | Meaning |
| - | - | - |
| `404` | MCP | The token or key is not recognised (missing, mistyped or revoked). The JSON-RPC error message explains how to connect |
| `402` | `/api/agent/*` | Payment required: the response carries the x402 payment requirements |
| `429` | `/api/scan` | A free-scan limit has been reached. The message says which and when it resets |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.