Authentication
Create an API key, send it as a bearer token on REST and MCP, and check it with the free GET /me.
Create a key
Sign in on your account page and create a key. Keys start with gx_. You can have several and revoke any of them there; a revoked key stops working at once.
Treat a key like a password. Keep it in an environment variable such as GEONDEX_API_KEY, not in code you commit.
Send it on every request
Send the key as a bearer token:
curl -s https://geondex.com/api/v1/me -H "Authorization: Bearer gx_YOUR_KEY"An X-API-Key: gx_… header works too.
The MCP server takes the same Authorization: Bearer gx_… header on https://geondex.com/mcp.
Check a key with GET /me
GET /api/v1/me is free. It shows who the key belongs to, the engines this server can ask, and both credit buckets:
{
"userId": "Zq3vN8pL2mT7wR5kB9cY1dF4",
"email": "you@example.com",
"engines": ["perplexity", "openai", "claude", "gemini"],
"credits": {
"plan": "starter",
"monthlyAllowance": 5000,
"allowanceRemaining": 4388,
"packRemaining": 1500,
"total": 5888
}
}total is allowanceRemaining plus packRemaining. Monthly credits are spent first. See Credits & pricing rules.
When the key is wrong
| HTTP | error.code | Meaning |
|---|---|---|
401 | unauthorized | No key was sent. Add the Authorization header. |
401 | invalid_api_key | The key was sent but is wrong or has been revoked. Create a new one on your account page. |
429 | rate_limited | More than 1,000 requests today on this key. Wait the number of seconds in the Retry-After header. |
The full list is on Errors & rate limits.
Browsers and CORS
The API is for scripts and agents; browser calls from other origins are not supported. To try a call in the browser, use the playground.
Machine-readable spec
The OpenAPI 3.1 document is at /api/v1/openapi.json. It needs no key, and it declares the bearer scheme, so a client generated from it sends the header for you.