---
title: "Authentication and limits"
description: "API keys and rate limits for the REST API (planned), and how the live MCP server signs in."
url: https://docs.sonderlabs.co.uk/authentication
---

# Authentication and limits

API keys and rate limits for the REST API (planned), and how the live MCP server signs in.

> **Early access:** The REST API below is in early access: its endpoints are the planned shape and are not open for self-serve use yet. [Request access](https://docs.sonderlabs.co.uk/access). Live today: the [MCP server](https://docs.sonderlabs.co.uk/mcp) and the [free datasets](https://docs.sonderlabs.co.uk/datasets).

## API keys (planned)

Each early-access team gets API keys from its Sonder workspace. Send the key as a bearer token on every request, over HTTPS only. Keys can be rotated and revoked from the workspace; keep them server-side.

Planned shape:

```http
GET /v1/posts/search?q=red+bull+rampage&platforms=tiktok,youtube HTTP/1.1
Host: api.sonderlabs.co.uk
Authorization: Bearer <your API key>
```

## Rate limits (planned)

Limits are set per key and agreed for each early-access team, by requests a minute and posts a month. Every response will say where you stand:

| Header | Meaning |
| --- | --- |
| `RateLimit-Limit` | Requests allowed in the current window. |
| `RateLimit-Remaining` | Requests left in it. |
| `RateLimit-Reset` | Seconds until it resets. |

Over the limit, you get `429 Too Many Requests` with `Retry-After`. Fresh searches across many platforms take longer than reads of data Sonder already holds, so large jobs will run as background jobs you poll.

## Errors (planned)

Error body:

```json
{
  "error": {
    "code": "invalid_platform",
    "message": "platforms: 'myspace' is not a supported platform."
  }
}
```

## MCP sign-in (live)

> **Live:** The MCP server at https://sonderlabs.co.uk/mcp signs in with OAuth 2.1: a member of a Sonder workspace approves the connection, and tools run with that member's permissions. Tool calls are limited to 60 a minute per member. Full flow: [auth.md](https://sonderlabs.co.uk/auth.md).