Skip to content
RunAPI Developer Docs
EN 中文
Guides
Guides

Authentication

Create an API key and authenticate requests to RunAPI.

View Markdown

RunAPI uses API keys to authenticate API requests. Send the key with every request that accesses your account or creates work.

Choose the right key

  • A standard API key calls the Task API, LLM API, and account endpoints. Create it from the API Keys page.
  • A management key creates and governs standard API keys and guardrails. Create it from the Management Keys page and use it only with Platform Management endpoints.

Create an API key

Give each application its own key so you can rotate or revoke access without interrupting other integrations. A key is bound to one account, and requests can access only resources visible to that account.

API keys do not have a fixed request-rate limit.

Authenticate a request

Send the API key as a bearer token in the Authorization header:

HTTP 
Authorization: Bearer YOUR_API_TOKEN

For example, request your current balance with cURL:

SHELL 
curl "https://runapi.ai/api/v1/me/balance" \
  -H "Authorization: Bearer YOUR_API_TOKEN"

Hosted MCP OAuth

Remote MCP clients connect to https://mcp.runapi.ai/mcp and use the canonical OAuth resource https://mcp.runapi.ai to discover the RunAPI authorization flow automatically. Sign in or create a RunAPI account, select an Account, and approve access without creating or sharing an API key.

RunAPI supports Dynamic Client Registration, authorization code with S256 PKCE, and rotating refresh tokens for Hosted MCP access.

OAuth discovery endpoints:

  • Protected Resource Metadata: https://runapi.ai/.well-known/oauth-protected-resource
  • Authorization Server Metadata: https://runapi.ai/.well-known/oauth-authorization-server

Review or revoke client access under Authorized apps.

Keep keys secure

  • Store API keys in a secret manager or encrypted credentials.
  • Never commit a key to source control or expose it in browser code.
  • Rotate a key immediately if it may have been disclosed.
  • Use separate keys for development and production.

Troubleshoot authentication

  • A 401 Unauthorized response means the key is missing, malformed, revoked, or invalid.
  • A 403 Forbidden response means the key is valid but its credential class or account role cannot perform the operation.
  • Confirm the header starts with Bearer, followed by one space and the complete key.
  • Confirm the key belongs to the account whose resources you are requesting.