# Authentication — AgentReady API

Every endpoint works anonymously with IP-bucketed rate limits — no signup needed to scan.
An API key moves you to a dedicated per-key bucket (your CI or shared egress IP no longer
counts against you) and ties usage to your organization.

## 1. Create a key

1. Sign in and open [https://agentready-rho.vercel.app/dashboard/keys](https://agentready-rho.vercel.app/dashboard/keys).
2. Create a key. The plaintext is shown **once** — store it in a secret manager.
3. Keys look like `ar_live_` followed by 32 base62 characters.

## 2. Send it as a Bearer token

Header format:

```
Authorization: Bearer ar_live_<32 base62 chars>
```

## 3. First authenticated call

```bash
curl -X POST https://agentready-rho.vercel.app/api/scan \
  -H "authorization: Bearer ar_live_YOUR_KEY" \
  -H "content-type: application/json" \
  -d '{"url": "example.com"}'
```

Malformed or revoked keys are ignored — the request still succeeds but falls back to
anonymous IP limits; auth failures never return 401 on public endpoints.

## Rate-limit tiers

| Tier | Bucket | Scans | Forced re-scans | Reads |
| --- | --- | --- | --- | --- |
| anonymous (no key) | per IP | 10/min · 30/day | 6/day | 60/min |
| free (keyed) | per key | 10/min · 30/day | 6/day | 60/min |
| pro / team (keyed) | per key | same buckets, raised on request | 6/day | 60/min |

Per-target floors apply to everyone: each domain can be scanned at most 2×/5min and
20×/day across all requesters. When you hit a limit you get `429` with a
`Retry-After` header and `retryAfterSeconds` in the JSON body — wait and retry.

## See also

- [https://agentready-rho.vercel.app/docs](https://agentready-rho.vercel.app/docs) — REST, MCP, SDK, and CLI reference
- [https://agentready-rho.vercel.app/api/openapi.json](https://agentready-rho.vercel.app/api/openapi.json) — OpenAPI 3.1 spec (`securitySchemes.apiKey`)
- [https://agentready-rho.vercel.app/agents.md](https://agentready-rho.vercel.app/agents.md) — how agents should use this site