> ## Documentation Index
> Fetch the complete documentation index at: /docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate REST and MCP requests

> Use scoped API keys for REST and OAuth for hosted MCP, manage credentials in the dashboard and keep secrets outside URLs, prompts and logs.

TruckerFetch authenticates REST with an API key and hosted MCP with an OAuth grant. Both use the current permissions and active Pro entitlement of the owning account.

## REST API keys

Create, rotate and revoke purpose-specific keys in [API keys](https://truckerfetch.com/dashboard/api/keys). Pass your secret over HTTPS in the bearer header:

```http theme={null}
Authorization: Bearer YOUR_API_KEY
```

Browser sign-in does not authenticate data API requests. Use a key with only the [scopes](/docs/scopes.md) your application needs. A key does not grant another account's watchlists, exports or historical access.

Keep keys in a secret manager or protected environment variable. Do not place them in query strings, a repository, webhook URLs, telemetry or assistant messages. Rotate a leaked key and revoke the old credential from the dashboard.

## Hosted MCP OAuth

Add `https://truckerfetch.com/api/mcp` to a compatible remote MCP client and follow its OAuth sign-in flow. Review the requested permissions on the TruckerFetch consent screen. An API key is not a hosted MCP OAuth token.

Review and revoke assistant connections in [Connections](https://truckerfetch.com/dashboard/api/connections). If an operation requests another scope, review the authorization prompt before retrying.

## Authentication failures

| Status | Action |
| - | - |
| `401` | Check that the credential is present, valid and not revoked or expired. |
| `402` | Verify that the owning account has active Pro access. |
| `403` | Check the required scopes, allowance and owner approval. |
| `404` | Verify the resource ID belongs to the current account and remains accessible. |

A downgrade or revocation can invalidate access after a successful request. Check current access again when resuming a job or download.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.