Every endpoint and tool is read-only over public data, so there is nothing to authenticate. Here is what to send instead, and the limits to respect.
There is nothing to sign up for and no token to store. Every endpoint and MCP tool runs with the same database permissions as an anonymous visitor to the website (Supabase row-level security), which is why it can only ever see approved, live products and completed public profiles. You can start calling the API from a shell, a browser or an agent immediately.
Send a User-Agent that identifies you.
Something like my-agent/1.0 (contact@example.com). It is optional, but it lets us reach you if an integration misbehaves instead of blocking the IP.
| Surface | Limit | Scope | Reported in |
|---|---|---|---|
/api/v1/* | 120 requests / minute | per IP | X-RateLimit-* |
/api/mcp | 60 requests / minute | per IP | X-RateLimit-* |
| llms.txt, Markdown mirrors | none | - | - |
Limits use a sliding one-minute window. When you exceed one, you get 429 Too Many Requests with a Retry-After header (seconds). REST responses are cached at the edge for five minutes, so repeated identical requests usually never count against you. Full details in Rate limits & caching.
All /api/v1 and /api/mcp responses include Access-Control-Allow-Origin: *, so browser-based agents, custom GPT actions and client-side apps can call them directly. Only GET (REST) and GET/POST/DELETE (MCP) are allowed.
/llms-full.txt or paginated /api/v1/products over crawling HTML pages if you need the whole catalogue.url) and the product’s own website (website). Do not present upvotes, ratings or revenue figures the API did not return.