> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reechee.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Anonymous, OAuth Connect, and API-key access - how each works and when to use it.

There are three ways to authenticate, all against the same base URL and MCP endpoint.

* **Anonymous** - no auth, three free read tools. Great for a quick answer.
* **Connect (OAuth)** - log in with your Reechee account in the browser, no key to paste.
  Best for MCP clients like Claude that support it. Tools follow your team's current plan.
* **API key** - a bearer token you generate and manage. Best for scripts, servers, and
  agents that spend credits.

## Anonymous

The free reads - product search, the pain-points taste, and competitors - need no
authentication at all. Just call the [REST endpoints](/api-reference/introduction) or
point an MCP client at `https://mcp.reechee.io/mcp`. Anonymous access is read-only and
[rate-limited by IP](/guides/rate-limits).

## Connect (OAuth)

For MCP, you can connect with your Reechee account instead of a key. Point the client at:

```
https://mcp.reechee.io/mcp/auth
```

The client discovers the OAuth flow, opens a browser to log in, and shows a short consent
screen ("Connect to Reechee"). Approve it and the client holds a token - nothing to copy
or paste. This is the recommended way to connect Claude and other clients that support it;
see [Connect Claude](/mcp/connect-claude).

**Why the `/mcp/auth` URL.** The bare `https://mcp.reechee.io/mcp` answers anonymously
(the 3 free tools) so a client that hits it never prompts you to log in. The `/mcp/auth`
variant returns a `401` that tells the client to run the OAuth flow. Same server, same
data - `/mcp/auth` just starts you at the login door.

**Tools follow your plan.** The connected token exposes exactly what your team's current
plan allows, evaluated on every request: a free team gets the 3-tool taste tied to your
identity; a paid team gets the full read + action set (twelve tools). Upgrade and the paid
tools light up on the next connect or tool refresh. The three **credit-spending** tools
appear only if you allow an optional **credit budget** on the consent screen - a rolling
30-day ceiling on what the connection can spend (all fifteen tools). Leave it empty and
the connection can never spend your credits. The budget is fixed for the life of the
connection; to change it, disconnect and reconnect with a new one.

**Token lifetime and disconnect.** Access tokens are short-lived (1 hour) and the client
refreshes them automatically in the background; a refresh session lasts 30 days. Disconnect
from the client's own connector settings whenever you like - it revokes the token
immediately, and the next request with it gets a `401`. Reconnect any time by approving the
consent screen again.

<Note>
  OAuth Connect and API keys are independent. Connecting an MCP client doesn't create or
  need a key, and revoking one never affects the other. Pick per client: Connect for a
  browser login, a key for headless use.
</Note>

## API key

Everything else - opportunities, full pain-point reports, the watchlist, credit balance,
and write actions - needs a paid-team API key.

### Create a key

In the app, go to **Settings → API keys** and create one. Keys are available to paid
teams (Starter and up). The full key is shown **once**, at creation - copy it then; it
can't be retrieved later.

A key looks like:

```
rch_live_3f9c…   (rch_live_ + 64 hex characters)
```

We store only a SHA-256 hash and a short display prefix - never the key itself.

### Use a key

Send it as a bearer token. For the REST API:

```bash theme={null}
curl "https://app.reechee.io/api/v1/opportunities" \
  -H "Authorization: Bearer rch_live_your_key_here"
```

For the MCP server, send the same header - see the per-client
[quickstarts](/mcp/connect-claude). With a valid key, the MCP exposes the full toolset
and `get_pain_points` returns the full report.

### Revoke a key

Revoke a key any time from **Settings → API keys**. Revocation is immediate - the next
request with that key gets a `401`.

### Errors

A missing key on a protected endpoint, or an invalid, revoked, or expired key, returns
`401 unauthorized`:

```json theme={null}
{ "success": false, "error": { "code": "unauthorized", "message": "API key required" } }
```

<Note>
  Keep keys server-side. Anyone with a key can act as your team within its limits. Treat
  it like a password; rotate it (create a new one, revoke the old) if it leaks.
</Note>