Authentication
Organization API keys (bmk_) for higher rate limits and attribution.
Authentication
Many public analysis endpoints work anonymously. Pass a Bearer organization API key when you need higher rate limits or want requests attributed to your org (for example MCP trust-report leads).
API keys
Keys are created in the customer app: Settings → API Keys (/account/settings/api-keys).
Format:
Authorization: Bearer bmk_your_organization_api_keyInvalid, expired, or revoked keys return 401. Omitting the header is allowed on public/MCP surfaces — anonymous rate limits apply.
Where keys matter
| Surface | Anonymous | Authenticated (bmk_) |
|---|---|---|
MCP /mcp | 30 req/min (IP) | 120 req/min (key id) |
| REST analysis | Subject to global rate limits | Same limits + org attribution where supported |
Admin and internal commercial routes are not documented here and require the services internal API key via the admin proxy — they are not callable with bmk_ keys from public clients.