Skip to main content
Every Profile, Profile Posts, Company, and Company Posts API request requires an active Superdata API key. Hosted MCP requests require an authenticated Superdata account through OAuth or an API key.

​
REST API keys

Send an active Superdata key in the authorization header on every REST request:
REST requests should accept JSON responses:
Create, review, and revoke keys from the Superdata Connections page. Never place a key in a query parameter or expose it in client-side code.

​
OAuth

Superdata supports authorization-code OAuth with PKCE for compatible public MCP clients. The protected-resource challenge identifies the authorization server and the required mcp:use scope. Optional OpenID and offline-access scopes may be requested by the client. The authorization flow verifies the token signature, issuer, audience, expiration, scope, client, and Superdata user before tool execution.

​
MCP API keys

You can also send an active Superdata key as an MCP bearer token:
MCP endpoints are Streamable HTTP. When calling Superdata directly with a raw HTTP request, include both JSON and stream content types in Accept:
Keys have the mcp:use scope. The owning account must remain active. A revoked, malformed, or unknown key receives the same generic authentication failure and does not consume a credit.

​
Authentication errors

HTTP 401 responses include a WWW-Authenticate challenge. Supported MCP clients can use that challenge to start OAuth automatically.