# Authentication

Every request carries an API key in the `Authorization` header, as a Bearer token. There is no other way to authenticate: keys in the query string are refused, so they never land in access logs.

```http
GET /api/v1/trends HTTP/1.1
Host: api.earlywave.ai
Authorization: Bearer ew_live_...
```

The OpenAPI document (`/api/v1/openapi.json`) is the only public address: it needs no key.

## Keys

Create and revoke keys in EarlyWave › **Settings › API & MCP** ([open it](https://www.earlywave.ai/settings/developers)).

- A key looks like `ew_live_` followed by 32 letters and digits.
- It is shown **once**, when you create it. EarlyWave stores only a hash of it and cannot show it again. Lost it? Create a new one and revoke the old one.
- Give each key a name (the machine or the integration that uses it), so you know which one to revoke.
- Settings shows when each key was last used and how many requests your keys made each day.
- Keys created before October 2026 (`sk-smrz_…`) keep working. New keys use the `ew_live_` format.

Treat a key like a password. Keep it on a server or in an environment variable; never ship it in a web page or a mobile app.

## Scopes

A key carries one or both scopes:

| Scope | Opens | Used by |
|---|---|---|
| `rest` | `https://api.earlywave.ai/api/v1/*` | your code, scripts, notebooks |
| `mcp` | `https://api.earlywave.ai/mcp` | Claude, Cursor, VS Code and other MCP clients |

A key without the right scope is refused: `403` with code `missing_scope` on the REST API, `401` on the MCP server. One key per integration, with only the scope it needs, keeps a leak small.

## Access

The REST API and the MCP server are included with Pro and Max ([plans](https://www.earlywave.ai/pricing)). Access is checked on every request, not only when the key is created: if the account's plan ends, its keys stop working until it is renewed.

All keys of an account share one rate limit and one monthly quota, REST and MCP together: 60 requests a minute and 10,000 a month on Pro, 300 and 50,000 on Max. See [Errors, limits and paging](https://www.earlywave.ai/developers/docs/errors-and-limits).

## What a key can read

- **Trends** (`/trends…`) are EarlyWave's catalogue, built from every source it reads. Any key sees the same trends, whatever its account follows.
- **Everything else** is the account's own data: its monitors, the feeds it follows, its folders, the articles of those feeds, its saved items. A feed, article, folder or monitor of another account answers `404`.
- **Discover** (`/discover`, `/feeds/discover`) searches every source EarlyWave reads, not only the account's feeds.

## Authentication errors

| Status | `error.type` | `error.code` | Meaning |
|---|---|---|---|
| 401 | `authentication` | `missing_api_key` | No `Authorization: Bearer …` header. |
| 401 | `authentication` | `invalid_api_key` | Unknown or revoked key. |
| 403 | `permission` | `missing_scope` | The key has no `rest` scope. |
| 403 | `permission` | `feature_not_available` | The account's plan does not include API access. |
| 403 | `permission` | `account_inactive` | The account is inactive. |
| 500 | `server` | `auth_unavailable` | The key could not be checked. Retry shortly. |

Example:

```json
{
  "error": {
    "type": "authentication",
    "code": "invalid_api_key",
    "message": "Unknown or revoked API key."
  }
}
```

The MCP server answers authentication failures before the MCP session starts, with a plain JSON body: `401` for a missing or unknown key or a key without the `mcp` scope, `403` when the account's plan does not include MCP or the account is inactive.

---
Source: https://www.earlywave.ai/developers/docs/authentication · All docs: https://www.earlywave.ai/llms.txt