Documentation
Authentication
API keys for the REST API and MCP server.
Request header
CopyAuthorization: Bearer sk-ndl-…
Every REST and MCP request uses the same header. Missing or invalid keys return 401.
Create a key
- 1
Open API keys in the dashboard.
- 2
Create a key. It looks like
sk-ndl-…. - 3
Copy it once. The full key is only shown then.
Scope
Each key is bound to one user and one organization. The dashboard, API, and MCP all work in the organization the key is bound to.
User
The key acts as the user who created it.
Organization
Requests run in the organization the key is bound to.
REST API
Send the header on every request to /api/v1. See the API Reference.
Copy
curl undefined/api/v1/me \ -H "Authorization: Bearer sk-ndl-…" \ -H "Content-Type: application/json"
MCP
Call tools with the same key. Listing tools at /mcp/v1/tools does not require a key. See the MCP catalog.
Copy
{
"mcpServers": {
"needle": {
"url": "undefined/mcp/v1",
"headers": {
"Authorization": "Bearer sk-ndl-…"
}
}
}
}