API Keys

Create and manage API keys to authenticate with the Rezolve Ai v1 API and the MCP server.

Create and manage API keys in the dashboard to authenticate with the v1 API, the SDK, the CLI, and the MCP server.

Where to manage keys

In the app, go to Settings, Developer console, Keys. You can create keys, view key prefixes, set scopes and rate limits, and revoke or delete keys.

Key format

Keys carry their environment in the prefix:

ace_live_... runs against your account for real and draws on your credit balance.
ace_test_... is free and capped by a monthly quota, which makes it the right choice for a first integration.

The full key is shown only once, at creation. Store it securely. The dashboard shows only the prefix afterwards, for identification.

Scopes

Assign one or more scopes when creating or editing a key. admin grants all of the others.

Scope	Unlocks
`enrichment:read`	Read jobs, job results, usage, feeds, and projects
`enrichment:write`	Everything above, plus running rules, content, and pipeline enrichment, and cancelling jobs
`utils:read`	The utility endpoints: language detection, agentic readiness, and review quality scoring
`webhooks:read`	List webhook subscriptions and their delivery history
`webhooks:write`	Everything above, plus creating, updating, and deleting webhooks
`ratings:read`	Read the customer star ratings and review text stored for your products
`ratings:write`	Everything above, plus sending ratings and reviews to `/v1/ratings/ingest`
`admin`	Full access to every resource

New keys get enrichment:read, enrichment:write, and utils:read by default. That is enough for the enrichment engine and the utilities, but not for webhooks: add webhooks:write if you plan to subscribe to job events.

ratings:write is never granted by default. Review text carries a public display name, so sending it is personal-data processing and has to be an explicit choice rather than something a key picks up automatically.

Scopes are enforced on the MCP server too. A tool whose scope your key lacks returns a 403 naming the scopes it needs, so widen the key rather than retrying.

Project scope

A key is either pinned to a project or account-wide.

Pinned: the key defaults to its own project, so you can omit projectId. Naming a different project returns 403 PROJECT_SCOPE_MISMATCH.
Account-wide: the key can reach any project on the account, but endpoints that return project-scoped rows require you to say which one. Omitting projectId returns 400 PROJECT_ID_REQUIRED:

{
  "error": {
    "code": "PROJECT_ID_REQUIRED",
    "message": "This endpoint returns project-scoped data. Pass ?projectId=<id>, or use a key pinned to a project."
  }
}

This applies to GET /feeds and GET /feeds/{id}. They previously merged rows from every project on the account when no project was named, with nothing in the response to say which project each row came from, so there was no safe way to read the result.

Either name the project:

curl "https://ace.authoritas.com/api/v1/feeds?projectId=<id>" \
  -H "Authorization: Bearer $ACE_API_KEY"

or pin the key to a project under Settings, Developer console, Keys and drop the parameter entirely.

Project ids come from GET /projects. See Error codes for the full list.

Environments and quotas

A ace_test_ key is free and metered against a monthly ceiling on both request count and units of work. When you exhaust it, calls return 402 TEST_QUOTA_EXCEEDED until the month rolls over. Check what is left with GET /api/v1/usage, which includes a testQuota block for test keys.

A ace_live_ key draws on your credit balance instead. See Credits and usage.

REST management (session auth)

To manage keys programmatically with session (cookie) auth:

List keys: GET /api/keys
Create key: POST /api/keys (body: name, optional scopes, rate_limit_per_minute, expires_at)
Get one key: GET /api/keys/[id]
Update key: PATCH /api/keys/[id] (for example scopes, rate limit, name)
Delete key: DELETE /api/keys/[id]

These routes require an authenticated session, not an API key.

Rate limits

Each key has a configurable requests per minute limit. When exceeded, the API returns 429 with Retry-After and X-RateLimit-* headers. Set the limit when creating or editing the key.