# Authentication

> Every billable call carries your API key. Keys are made in the console, shown once, and can be rotated or revoked at any time.

Canonical page: https://clawifi.dev/docs/authentication

## Send the key

Send the key as `Authorization: Bearer <key>`. The remote MCP server also accepts it in `X-Clawifi-Api-Key`.

**cURL**

```sh
curl https://api.clawifi.dev/fetch \
  -H "Authorization: Bearer $CLAWIFI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'
```

## Get a key

Create an account at [/signup](https://clawifi.dev/signup). The Free plan includes 1,000 credits a month. Verify your email, then copy the API key the console shows you. It is shown once.

## Rotate or revoke

Create, rotate and revoke keys under API keys in the [console](https://clawifi.dev/account?view=keys). A revoked key stops working at once. If a key is exposed, rotate it.

## Without a key

Without a key, search_free, fetch_url, scrape_url (with passages) and map_site still work as a trial: 12 calls a minute and 50 a day per address, with the playground's caps. Past that the tool answers with a link to get a free key at https://clawifi.dev/signup.