Authentication and keys
Requests are authenticated with an API key, a website session, or a connected app. For a first request, start with the quickstart; rate limits and allowances are in Limits and usage.
Access modes
| access | routes | what you send |
|---|---|---|
| public | /health, /health/live, /v1/auth/tiers, /openapi.json, the API reference | none |
| API key | every other data, AI, and account-read route under /v1 | Authorization: Bearer <key> |
| website session | your account pages on tauric.ai (keys, usage, connected apps) | a signed-in session on the website |
| connected app | the hosted MCP server | an MCP client you signed in and approved (connected apps) |
Keys
Send your key in the Authorization: Bearer header on every request that needs one:
curl https://api.tauric.ai/v1/auth/whoami \
-H "Authorization: Bearer $TAURIC_API_KEY"
Treat the key as an opaque secret. It is shown once, when it is issued; if you lose it, revoke it and create a new
one. Key listings show only a short preview. A missing, unknown,
inactive, or expired key gets 401 or 403 with a typed code (error codes).
GET /v1/auth/whoami describes the key you send: its account, key id, principal, tier, and the entitlements it may use now.
Manage keys on the website
An API key reads GET /v1/account and GET /v1/account/usage for its own account, and a connected app reads them
too; managing keys stays on the website.
On the API keys page (tauric.ai/settings/api-keys) you list your keys (previews only), revoke a key, and create a key with a name (1–64 characters) and an expiry: never, 30 days, 90 days or 1 year. An account holds at most 10 live keys.
Entitlements
What a request may do comes from your account's tier; a key is only a name and an optional expiry.
GET /v1/auth/tiers lists each tier's entitlements:
| entitlement | allows |
|---|---|
data | the data routes |
ai | the AI routes: /v1/chat/completions, /v1/responses, /v1/agents/copilot/…, and /v1/research/agentic/analyze |
mcp | the hosted MCP server |
sessions | the session archives of the Tauric applications you use |
How you connect narrows that set. A key has all of its tier's entitlements. A website session never uses the MCP
server, and it reads and deletes session archives but does not write them. A connected app has
data, ai, and mcp, never the session archives.
A request that needs an entitlement you do not have is refused 403 entitlement_required; the error's entitlement
names it, and nothing is charged.
Connected apps
An MCP client that supports sign-in (Claude, ChatGPT, Claude Code) acts as your account without an API key
(connecting). Your tier needs the mcp entitlement, and your limits apply.
Each connected app is listed on the Connected apps page (tauric.ai/settings/connected-apps), where Disconnect stops it at its next request; connect again to restore it. A connection lasts at most 90 days and ends after 30 days unused.