Authentication

Every request carries an API key in the Authorization header, as a Bearer token. There is no other way to authenticate: keys in the query string are refused, so they never land in access logs.

GET /api/v1/trends HTTP/1.1
Host: api.earlywave.ai
Authorization: Bearer ew_live_...

The OpenAPI document (/api/v1/openapi.json) is the only public address: it needs no key.

Keys#

Create and revoke keys in EarlyWave › Settings › API & MCP (open it).

• A key looks like ew_live_ followed by 32 letters and digits.
• It is shown once, when you create it. EarlyWave stores only a hash of it and cannot show it again. Lost it? Create a new one and revoke the old one.
• Give each key a name (the machine or the integration that uses it), so you know which one to revoke.
• Settings shows when each key was last used and how many requests your keys made each day.
• Keys created before October 2026 (sk-smrz_…) keep working. New keys use the ew_live_ format.

Treat a key like a password. Keep it on a server or in an environment variable; never ship it in a web page or a mobile app.

Scopes#

A key carries one or both scopes:

A key without the right scope is refused: 403 with code missing_scope on the REST API, 401 on the MCP server. One key per integration, with only the scope it needs, keeps a leak small.

Access#

The REST API and the MCP server are included with Pro and Max (plans). Access is checked on every request, not only when the key is created: if the account's plan ends, its keys stop working until it is renewed.

All keys of an account share one rate limit and one monthly quota, REST and MCP together: 60 requests a minute and 10,000 a month on Pro, 300 and 50,000 on Max. See Errors, limits and paging.

What a key can read#

• Trends (/trends…) are EarlyWave's catalogue, built from every source it reads. Any key sees the same trends, whatever its account follows.
• Everything else is the account's own data: its monitors, the feeds it follows, its folders, the articles of those feeds, its saved items. A feed, article, folder or monitor of another account answers 404.
• Discover (/discover, /feeds/discover) searches every source EarlyWave reads, not only the account's feeds.

Authentication errors#

Example:

{
  "error": {
    "type": "authentication",
    "code": "invalid_api_key",
    "message": "Unknown or revoked API key."
  }
}

The MCP server answers authentication failures before the MCP session starts, with a plain JSON body: 401 for a missing or unknown key or a key without the mcp scope, 403 when the account's plan does not include MCP or the account is inactive.