Authentication

API keys belong to your account. Sign in free (no card), mint a key, and keys and usage history are one identity.

Get a key

Or from the terminal, with your signed-in session — key creation requires an account, because the key shares the account's weekly limit:

bash

curl -X POST https://www.stipple.sh/v1/keys \
  -H "Content-Type: application/json" \
  -b "stp_session=<your session cookie>" \
  -d '{}'

# → { "api_key": "stp_...", "key_id": "key_...", ... }

The key is shown once and never stored in plaintext on our side — only a hash. Lose it, mint a new one (up to 5 per email).

Use it

Send the key on every request — REST and MCP alike — as a Bearer token:

bash

curl -X POST https://www.stipple.sh/v1/verify-references \
  -H "Authorization: Bearer stp_..." \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/report.pdf"}'

A presented-but-invalid key returns 401 — it never silently falls back to the anonymous quota, so typos and revocations surface immediately.

Limits

Parameter	Type	Description
Anonymous	per IP	Reads, tender browsing and the sandbox are unlimited. Every checker allows 20 a week.
API key	per account	100 checks a week, the same weekly limit as signing in on the web.
Signed in (web)	per account	100 checks a week across every tool — one identity for keys and history.
Burst guard	all	~10 requests at once, refilling ~30/min.

Current limits and the paid tender-preparation price: GET /v1/pricing or the pricing page.

Check your usage

Usage is metered by the same counters that enforce the quota, so what you read is exactly what's enforced:

bash

curl https://www.stipple.sh/v1/usage -H "Authorization: Bearer stp_..."

# → {
#     "key_id": "key_…",
#     "current": { "used": 12, "remaining": 38, "reset_at": "…" }
#   }

MCP

MCP clients that support custom headers can send the same Authorization header on the server connection — the tools then meter against your key instead of your egress IP. See MCP integration.

Good to know

Keys are free, and every checker is free — the only paid product is preparing a tender.
Need a higher limit for a real integration? Contact us — limits are per key and adjustable.
To revoke a key today, contact us; self-serve revocation ships with the dashboard.