> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.pixalate.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pixalate.com/_mcp/server.

# Authentication and API keys

> How to authenticate to Pixalate's APIs with the x-api-key header, how to get an API key, and how to keep it safe.

Pixalate's REST APIs authenticate each request with an API key. You send the key in the `x-api-key` HTTP header. There are no sessions or tokens to manage.

## Send your key in the x-api-key header

Add the header to every request:

```bash
curl "https://api.pixalate.com/api/v2/mrt/apps?pretty=true" \
  -H "x-api-key: $PIXALATE_API_KEY"
```

That example calls the Enrichment API's metadata endpoint, which returns your quota status without using any quota. It's a good way to check that your key works.

The header is the same for the [Fraud API](/apis/fraud-api), [Enrichment API](/apis/enrichment-api), [Analytics Reports API](/apis/analytics-reports-api), [SCO Validation & Verification API](/apis/sco-api) and [OpenEPG Enrichment API (preview)](/apis/openepg).

If the key is missing or wrong, the API returns `401 Unauthorized`. See [Quotas, limits and errors](/apis/quotas-and-errors) for the other status codes.

> **Note**
>
> Pixalate's MCP connectors usually sign you in through a browser, so you don't need an API key. If your assistant can't complete a browser sign-in, you can send this same API key in an `x-api-key` header instead. See [Sign in with an API key](/mcp/access#sign-in-with-an-api-key).

## Get an API key

How you get a key depends on the API.

| API                               | How to get access                                                                                                 |
| --------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
| Fraud API                         | Sign up on the [Pixalate developer portal](https://developer.pixalate.com), or ask your Pixalate account manager. |
| Enrichment API                    | Sign up on the [Pixalate developer portal](https://developer.pixalate.com), or ask your Pixalate account manager. |
| SCO Validation & Verification API | Sign up on the [Pixalate developer portal](https://developer.pixalate.com), or ask your Pixalate account manager. |
| Analytics Reports API             | Ask your Pixalate account manager. Access is for Pixalate Analytics subscribers.                                  |
| OpenEPG Enrichment API (preview)  | Ask your Pixalate account manager. The API is in preview.                                                         |

### Self-serve sign-up

#### Create an account

Go to the [Pixalate developer portal](https://developer.pixalate.com) and select **Get API Key**.

#### Choose a plan

The portal lists free and paid plans for the Fraud API, the Enrichment API and the SCO Validation & Verification API. Check the portal for each plan's current allowance.

#### Copy your key

Your API key is on your account page in the portal. Store it somewhere safe (see below), then make a test call.

### Through your account manager

If you have a contract with Pixalate, or you need the Analytics Reports API or the OpenEPG preview, contact your Pixalate account manager. If you used a username and password with an older Pixalate API, see [Migrating from legacy APIs](/apis/legacy-apis).

## Keep your key safe

Your API key identifies your account. Anyone who has it can use your account's access and quota.

* **Call the APIs from your servers.** Don't put the key in a mobile app, a CTV app, browser JavaScript or any other code you ship to users. Anything you ship can be extracted.
* **Send the key only in the header.** Never put it in a URL or query string. URLs end up in logs, browser history and analytics tools.
* **Keep it out of source control.** Load it from an environment variable or a secrets manager rather than hard-coding it.
* **Limit who can see it.** Share it only with the people and systems that need it.
* **Act quickly if it leaks.** If you think someone else has your key, contact [support@pixalate.com](mailto:support@pixalate.com) or your Pixalate account manager.

## Related

#### [Pixalate APIs](/apis/overview)

Which API to use, with base URLs.

#### [Quotas, limits and errors](/apis/quotas-and-errors)

How usage is counted and what each status code means.