Authentication

The filtrat API uses API keys. Every request must include one in the Authorization header. There are no separate test keys: every call runs on your real account and spends your real credits.

Send the key

Put the word Bearer, one space, then the key:

Authorization: Bearer ak_your_key

For example:

curl https://api.filtrat.io/v1/credits/balance \
  -H "Authorization: Bearer ak_your_key"

The same header works for the API, the MCP server, Clay and n8n.

Create a key

1. Open API → API keys in the app.
2. Press Create key and name it after where you'll use it (Production, Clay, Claude).
3. Copy the key from the Copy your key window. It is shown only once.

After you close that window, the list shows only the key's first characters (its prefix), when it was created and when it was last used. If you lose a key, create a new one and revoke the old one.

You can also create, list and revoke keys from code with POST /v1/api-keys, GET /v1/api-keys and DELETE /v1/api-keys/{key_id}. A key created through the API can be given an expiry date with expires_at (ISO 8601). Expired keys show Expired in the list.

Revoke a key

Press the bin icon next to a key and confirm. Anything using that key stops working at once, and this can't be undone.

Revoke a key straight away if it may have been exposed, for example committed to a repository, pasted in a chat or sent by email.

Keep keys safe

• Store keys in environment variables or a secrets manager, not in source code.
• Never put a key in a browser, mobile app or anything a user can inspect.
• Don't share keys between people. Each person can create their own.
• We store only a fingerprint of each key, never the key itself, so we can't show it to you again.

When authentication fails

A missing, wrong, revoked or expired key returns 401 with the code UNAUTHORIZED:

{"error": {"code": "UNAUTHORIZED", "message": "Not authenticated", "detail": {}}}

Check that:

• the header is exactly Authorization: Bearer ak_…, with one space after Bearer;
• the key was copied in full, with no spaces or line breaks;
• the key hasn't been revoked or expired on API → API keys;
• the email address of your filtrat account is confirmed. Keys don't work until it is.

A valid key on a plan that doesn't include a feature returns 403 PLAN_REQUIRED instead. See Errors.