# Authentication

Public data on the Assyro API needs no key. How anonymous requests are identified and limited.

Source: https://www.assyro.com/docs/authentication

> **Note:** Preview: `api.assyro.com` is not serving production data yet. Requests and responses on this page follow the published contract and may change before launch.

Reading public data needs no account and no key: send the request without credentials. Anonymous requests are limited per IP address (see [Rate limits](https://www.assyro.com/docs/rate-limits)).

> **Warning:** Do not send an `Authorization` or `x-api-key` header to `/v1/query`. The anonymous endpoint refuses any credential with `400 invalid_request`, so a key can never be sent where it is not used.

## API keys

API keys are created in Assyro Intelligence under Settings, API keys, and are used today by the [MCP server](https://www.assyro.com/docs/mcp). Keys for this API are in development; this page will document them when they are available.