variants[].url buy links credit your vendor account. Both tiers can use search_catalog, lookup_catalog, and get_product.
The two tiers
| Tier | How you qualify | Typical limit (per minute) | Affiliate variants[].url |
|---|---|---|---|
| Token | Valid Channel3 API key in x-api-key (or Authorization: Bearer) | 1000 | Your vendor_id |
| Anonymous | No key, invalid key, or UCP CLI | 30 | public_ucp (not credited to you) |
x-ucp-auth-tier (token or anonymous).
Which should I use?
Token (API key) — use this for production traffic and monetized buy links. Create a key in the dashboard and send it on every MCP POST via curl or your MCP client. The UCP CLI cannot send keys on Channel3. Anonymous — fine for quick tests, the quickstart, and all UCP CLI catalog commands. Too low for real traffic; buy URLs are not attributed to your vendor. A bad API key does not return 401. You get anonymous limits instead.Good to know
- Edge limits too. Cloudflare also rate-limits by IP on claimed headers. The origin enforces the verified tier so a fake
x-api-keycannot borrow token limits. - Auth is on HTTP headers, not in
meta. See About profiles.
Token (API key)
Sendx-api-key: ch3_live_... on every MCP POST.
Step-by-step setup
Anonymous (no auth)
Omit the API key header. QuickstartWhat’s next
Quickstart
Try it with no key
Add an API key
Move to Token tier