Authorization

The Get Started page covers how to mint an API key. This page covers how to pass it.

If you are connecting claude.ai or Claude Desktop, you authenticate with OAuth at https://api.remoet.dev/mcp/oauth instead and the connector holds its own key. See MCP server.

The Bearer header and the 401 bodies below are then not yours to handle. Two other things on this page still are: the rate limits, counted per account rather than per route, and the 365-day key lifetime, which expires a connector on the same clock.

Bearer scheme

All REST endpoints use the standard Authorization: Bearer <key> header.

GET /user/hello HTTP/1.1
Host: api.remoet.dev
Authorization: Bearer your_api_key_here

cURL:

curl -H "Authorization: Bearer your_api_key_here" https://api.remoet.dev/user/hello

JavaScript fetch:

const res = await fetch("https://api.remoet.dev/user/hello", {
  headers: { Authorization: `Bearer ${process.env.REMOET_API_KEY}` },
});

What a bad key returns

The exact 401 body depends on what is wrong with the request:

// Authorization header is missing entirely
{ "message": "Unauthorized", "statusCode": 401 }
 
// Header is present but the key isn't recognised
{ "message": "Invalid API Key", "error": "Unauthorized", "statusCode": 401 }
 
// Key is recognised but expired or revoked
{ "message": "API Key Expired", "error": "Unauthorized", "statusCode": 401 }

To tell “missing header” from “bad key” in your client, key off message. See Errors for the full catalog.

Key lifetime

A key is valid for 365 days from the moment it is created, and there is no renewal in place: you mint a new one. Nothing warns you as the date approaches, so put the rotation in your own calendar if the integration matters. Past the date every request returns:

{ "message": "API Key Expired", "error": "Unauthorized", "statusCode": 401 }

Revoking a key at www.remoet.dev/agents  produces the same response immediately, so treat that body as “this key is finished, get another one” rather than as a transient failure. Never retry it.

Keeping the key safe

Treat the key like a password. Never ship it to the browser: use it from server-side code, or from .env files that are not committed. If a key leaks, revoke it at www.remoet.dev/agents  and generate a new one. Revocation takes effect on the next request.

Rate limits

Two layers:

• Burst: 60 requests per minute per endpoint, 30 per minute on /user/full.
• Daily: 5,000 REST requests per account per day, reset at 00:00 UTC. MCP has its own separate 5,000.

Both return 429. The bodies differ, so you can tell them apart. See Errors and Limits.

MCP

The MCP server takes the same key on Authorization: Bearer <key> at https://api.remoet.dev/mcp. See MCP server.