API reference
API authentication
Written and maintained by The ProspectAPIs team
ProspectAPIs API authentication is a secret API key sent as a Bearer token in the Authorization header of every /v1 request. The key identifies your account, so it decides whose credits a call spends and whose watchlists and research jobs it can read. Three routes need no key at all.
The Bearer header
Authorization: Bearer pa_live_<48 hex characters>The scheme is the word Bearer, one space, then the key. Any other scheme, or no header, answers 401 before anything runs. A key in a query string or a request body is not read.
curl https://api.prospectapis.com/v1/account \
-H "Authorization: Bearer $PROSPECTAPIS_KEY"API keys
Create keys on the API keys page of the dashboard. A key is pa_live_ followed by 48 hex characters. It is shown once, when you create it; we keep only its SHA-256 hash, so a lost key cannot be shown again, only replaced. An account can hold up to 25 active keys. Every key on an account spends the same credits; the request rate limit is counted per key.
Revoking a key in the dashboard takes effect on the next request: every call checks that the key is still active. Keep keys on the server or in your agent's environment, never in a browser bundle or a public repository.
Routes without a key
GET /v1/version, GET /pricing and GET /health answer without a key and are never billed. Every other /v1 route needs one.
When authentication fails
| Status | Body | Cause |
|---|---|---|
| 401 | { "error": "Missing API key", "message": "Send your key as: Authorization: Bearer pa_live_..." } | No Authorization header, or a scheme other than Bearer. |
| 401 | { "error": "Invalid API key" } | A key that is malformed, unknown or revoked. |
| 503 | { "error": "Authentication is unavailable, retry shortly" } | The key could not be checked. Nothing was run or charged; retry. |
None of these is billed. The full list of statuses is on errors.
The hosted MCP server
The hosted MCP server at https://api.prospectapis.com/mcp takes the same key in the same header. Clients that support remote servers can instead sign in with OAuth, and the connected app then shows in your key list, where you can revoke it.
Agents send their messages as POST /mcp, with the key as a Bearer token or with the OAuth sign-in. MCP clients find that sign-in through GET /.well-known/oauth-protected-resource and GET /.well-known/oauth-protected-resource/mcp (RFC 9728), so most of them only need the URL. To try it with no key at all, POST /mcp/free at https://api.prospectapis.com/mcp/free answers a small free tier: funding search, one funding record, the price list and the version, with the limits on rate limits.
Next: make a first call in the quickstart, or browse every operation in the API reference. No key yet? Create a free account and make one in the dashboard. Giving that key to an agent safely is part of researching prospects with an AI agent.