> ## Documentation Index
> Fetch the complete documentation index at: https://docs.superdata.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate to Superdata's REST APIs and hosted MCP service.

Every Profile, Profile Posts, Company, and Company Posts API request requires an
active Superdata API key. Hosted MCP requests require an authenticated Superdata
account through OAuth or an API key.

## REST API keys

Send an active Superdata key in the authorization header on every REST request:

```http theme={null}
Authorization: Bearer sd_live_your_key_here
```

REST requests should accept JSON responses:

```http theme={null}
Accept: application/json
```

Create, review, and revoke keys from the Superdata **Connections** page. Never
place a key in a query parameter or expose it in client-side code.

## OAuth

Superdata supports authorization-code OAuth with PKCE for compatible public MCP
clients. The protected-resource challenge identifies the authorization server
and the required `mcp:use` scope. Optional OpenID and offline-access scopes may
be requested by the client.

The authorization flow verifies the token signature, issuer, audience,
expiration, scope, client, and Superdata user before tool execution.

## MCP API keys

You can also send an active Superdata key as an MCP bearer token:

```http theme={null}
Authorization: Bearer sd_live_your_key_here
```

MCP endpoints are Streamable HTTP. When calling Superdata directly with a raw HTTP
request, include both JSON and stream content types in `Accept`:

```http theme={null}
Accept: application/json, text/event-stream
```

Keys have the `mcp:use` scope. The owning account must remain active. A revoked,
malformed, or unknown key receives the same generic authentication failure and
does not consume a credit.

## Authentication errors

HTTP `401` responses include a `WWW-Authenticate` challenge. Supported MCP
clients can use that challenge to start OAuth automatically.