Authentication

Every protected request carries a bearer token:

Authorization: Bearer sk_viralquery_...

Get a key through an active subscription. Keys are shown once, so store yours in a secure client secret or environment variable—never in a prompt, URL, or source file.

What your key lets an agent do

A valid key can:

• set its one app or website workspace,
• update its research brief, including optional competitors,
• update plain-English research rules,
• run tenant-scoped scrolls,
• read its private library, outliers, trends, and hooks,
• save tenant-owned tags and notes on library videos,
• inspect its current usage.

Plan-gated requests need an active subscription (402 subscription_required). Daily research capacity is enforced by the service; there is no monthly scroll gate. See Subscription & usage.

Rotation and recovery

ViralQuery stores only a hash of your key. If you lose or suspect a key, use the email-code recovery flow to rotate it. Rotation immediately invalidates the old key, so update every MCP, CLI, and API configuration that used it.