Authentication

Every /v1 route requires a Bearer key.

Authorization: Bearer fds_live_<kid>_<secret>

The value is the word Bearer, one space, then the key. Do not send the key twice. Do not put Bearer inside the key.

Public (no auth):

• GET https://api.fulldatasets.com/health
• GET https://api.fulldatasets.com/openapi.json

MCP uses the same header on https://mcp.fulldatasets.com/mcp.

Key format

fds_live_<kid>_<secret>

Part	Meaning
fds_live	Environment prefix (v1 is live only)
kid	Key id. Used for rate limits and revocation lookup
secret	Secret. Hashed at rest; treat it like a password

Keys are issued by hand. Request one. There is no self-serve dashboard in v1.

Failures

Status	When
401	Missing header, malformed key, unknown kid, or revoked
429	More than 120 requests / 60 seconds for this kid

Error body:

{ "error": { "code": "rate_limited", "message": "…" } }

See Errors.

Usage

Each authenticated /v1 call is metered asynchronously (API → queue → Postgres). Do not treat usage rows as a synchronous response field. /health and /openapi.json are not billed.

MCP

Cursor (and any streamable-HTTP client):

{
  "mcpServers": {
    "fulldatasets": {
      "url": "https://mcp.fulldatasets.com/mcp",
      "headers": {
        "Authorization": "Bearer fds_live_<kid>_<secret>"
      }
    }
  }
}

If initialize fails with 401, the header is wrong — not the tool names.