Authentication

Authenticate every Rankfield API request with your API key in the Authorization header, and keep the key safe.

#Send the key

Every endpoint under https://rankfield.dev/v1/ and the MCP server need the key in the Authorization header:

Authorization: Bearer ls_your_key

The same key works for every endpoint. Get one from the API key panel. Keys do not expire.

#When the key is missing or wrong

The answer is 401 with a WWW-Authenticate: Bearer header. Check that the header reads exactly Bearer followed by the key, with no quotes or line break.

{
  "error": {
    "message": "A valid API key is required"
  }
}

#Get a key from code

Agents and scripts can ask for a key without a browser:

curl -sS -X POST https://rankfield.dev/v1/keys -H 'Origin: https://rankfield.dev'

The Origin header is required. Reuse one key rather than asking for a new one per run. When key issuance is at capacity, the answer is 429; try again later.

#Keep your key safe

• Load it from an environment variable or a secret store. Never commit it, paste it in an issue, or put it in a screenshot or log.
• Send it only in the Authorization header over HTTPS. Never put it in a URL, where it ends up in logs and browser history.
• Keep it on your server. Browser JavaScript and mobile apps would expose it, and the API does not send CORS headers anyway.
• An agent should never print the key in its answer.