Skip to main content

API keys

Every endpoint except /health and /ready needs an API key. Send it in the X-API-Key header:
Create a key on the dashboard.
Never put your API key in browser code. Call Prefetch from your own backend instead. To show logos in a browser, use the logo CDN, whose token is safe to publish.

Bearer tokens

POST /mcp also accepts your key as a bearer token, because many MCP clients only offer an Authorization field:
If you send both, X-API-Key wins. This applies to /mcp only: REST endpoints need X-API-Key. See MCP server for client setup.

OAuth for apps

Apps that can’t hold an API key, such as Claude, ChatGPT and Claude Desktop, sign you in instead. You approve the app on prefetch.io, and it gets an access token that it sends as a bearer token:
You never handle the token yourself. The app gets it, refreshes it and stores it. Its calls bill the newest active API key on your account (the one on your dashboard) and go through the same checks as a key. Access tokens work on the REST endpoints too. A request with no credentials gets a 401 whose WWW-Authenticate header points at /.well-known/oauth-protected-resource (or /.well-known/oauth-protected-resource/mcp for the MCP server). That’s how an app finds where to sign you in. To remove an app’s access, select Disconnect under Connected Apps on the dashboard. Its next call fails, even if its token hasn’t expired.

How keys are checked

Every request checks your key in this order:
  1. Present: the key is in the header.
  2. Not revoked: nobody revoked it.
  3. Not expired: it hasn’t passed its expiry date.
  4. Within its credit limit: it hasn’t used its credits.
A missing key, or an expired or disconnected access token, returns 401. Every other failure returns 403.

Keeping keys safe

  • Use separate keys for development and production.
  • Set a credit limit on each key so a bug can’t spend your whole balance.
  • Rotate keys regularly on the dashboard.
  • Revoke a leaked key straight away.
See the production checklist before you launch.