API keys - Syrto

Most MCP clients connect to Syrto by signing you in with OAuth - you add the server URL and follow the login prompt, as described in Setup. That needs a person at the keyboard. For scripts, scheduled jobs, CI pipelines and server-to-server integrations, the Syrto MCP server also accepts an organization API key sent as a bearer token. No sign-in flow runs; the key is checked on every request.

	Sign in (OAuth)	Organization API key
Identifies	You and your organization	Your organization only - no person
Suited to	AI assistants used by people	Scripts, automation, server-to-server integrations
Tools available	All	All except the five that need a person
Rate limits	Counted per person	Shared by all of the organization’s keys
Usage billed to	Your organization	Your organization

Create a key

API keys are created by an organization admin in the Syrto dashboard, under Settings → API keys. They are the same organization keys used by the Syrto API, so a key you already have for the API works here too. Keys begin with sk_. Treat a key like a password: it grants access to your organization’s data and consumes its usage. Keep it in a secret store or an environment variable, never in a URL, a prompt, or a file you commit.

Only organization keys are accepted. The personal keys you can create under Profile → API keys are refused with 401 Unauthorized, because an API key is meant to identify an organization rather than a person. To use Syrto as yourself, sign in with OAuth instead.

Send the key

Point your client at the Syrto MCP server and send the key in the Authorization header:

URL:    https://mcp.syrto.ai/mcp
Header: Authorization: Bearer sk_...

The examples below read the key from a SYRTO_API_KEY environment variable:

export SYRTO_API_KEY=sk_...

Claude Code
VS Code
HTTP

Add the server with a fixed Authorization header:

claude mcp add --transport http syrto https://mcp.syrto.ai/mcp \
  --header "Authorization: Bearer $SYRTO_API_KEY"

Your shell expands $SYRTO_API_KEY when you run the command, so Claude Code stores the key itself in its configuration.

Add the server to .vscode/mcp.json. The inputs entry makes VS Code ask for the key once and store it securely, so it never appears in the file:

{
  "inputs": [
    {
      "type": "promptString",
      "id": "syrto-api-key",
      "description": "Syrto API key",
      "password": true
    }
  ],
  "servers": {
    "syrto": {
      "type": "http",
      "url": "https://mcp.syrto.ai/mcp",
      "headers": {
        "Authorization": "Bearer ${input:syrto-api-key}"
      }
    }
  }
}

Any MCP client or SDK that can send custom HTTP headers works the same way. To check a key from the command line, send an initialize request:

curl -s https://mcp.syrto.ai/mcp \
  -H "Authorization: Bearer $SYRTO_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"curl","version":"1.0"}}}'

A valid key returns the server’s name and capabilities. A 401 Unauthorized means the key was not accepted - see Errors.

What an API key cannot do

An organization key carries no person, so the tools for official documents, person contacts and personal usage are not offered on a key connection:

Tool	Why it needs a person
`syrto_list_official_documents`	Reports the organization’s credit balance, which is only available to a signed-in user
`syrto_request_official_document`	Spends the organization’s credits on someone’s behalf
`syrto_get_person_contacts`	Records who looked a person up, and reports the credit balance
`syrto_request_person_contacts`	Spends the organization’s credits on someone’s behalf
`syrto_get_usage`	Reports one person’s own consumption

They are left out of the tool list, and calling one anyway returns an error saying the tool needs a signed-in user. Every other tool works with a key, including company and person search, company profiles, structure, metrics and analysis.

Rate limits and usage

The rate limits apply to the organization as a whole when you use an API key: every key belonging to the organization draws on one shared set of limits, so creating more keys does not raise them. Plan for this before pointing a high-volume pipeline at a key. Usage made with a key is billed to the organization’s Syrto AI allowance, just like usage from signed-in members.

Revoke a key

An admin deletes keys from the same Settings → API keys page in the dashboard. A deleted or expired key stops working within about a minute.

Errors

A key that is not accepted always gets 401 Unauthorized. The usual causes:

No Authorization header, or it is not in the form Bearer sk_....
The key is mistyped, deleted, or expired.
The key is a personal key from Profile → API keys rather than an organization key.

​Sign-in or API key

​Create a key

​Send the key

​What an API key cannot do

​Rate limits and usage

​Revoke a key

​Errors

Sign-in or API key

Create a key

Send the key

What an API key cannot do

Rate limits and usage

Revoke a key

Errors