Auth and rate limiting

How you identify yourself sets your rate limit and whether variants[].url buy links credit your vendor account. Both tiers can use search_catalog, lookup_catalog, and get_product.

​

The two tiers

Limits can change. Check the response header x-ucp-auth-tier (token or anonymous).

​

Which should I use?

Token (API key) — use this for production traffic and monetized buy links. Create a key in the dashboard and send it on every MCP POST via --header, profile headers.json, curl, or your MCP client. Anonymous — fine for quick tests and the quickstart without a key. Too low for real traffic; no monetization. A bad API key does not return 401. You get anonymous limits instead.

​

Good to know

• Edge limits too. Cloudflare also rate-limits by IP on claimed headers. The origin enforces the verified tier so a fake x-api-key cannot borrow token limits.
• Auth is on HTTP headers, not in meta. See About profiles.

​

Token (API key)

Send x-api-key: ... on every MCP POST. Step-by-step setup

​

Anonymous (no auth)

Omit the API key header. Quickstart

​

What’s next