Authentication

Safety: Treat API keys like passwords. Don’t paste them in screenshots or share them publicly.

API keys

Generate your API key in the dashboard (API access section). Your account has one active API key at a time: generating a new key immediately invalidates the previous one.

API access is included in plans that carry the Public API feature. Read endpoints keep working with an existing key; write endpoints (like page creation) re-check your current plan on every call.

How to send the key

Send your key in the Authorization header:

Authorization: Bearer YOUR_API_KEY

Requests without the header return 401 with code api_key_required; an unknown key returns 403 with code invalid_api_key.

Query parameter (MCP server only)

The hosted MCP server also accepts the key as an apiKey query parameter, as a fallback to the Authorization header:

https://onlynk.me/api/mcp/mcp?apiKey=YOUR_API_KEY

This exists because some MCP clients, notably Claude.ai’s, Claude Desktop’s and Cowork’s custom-connector setup, only let you configure a server URL, with no field for custom headers. Paste the URL above (with your key filled in) straight into the connector’s “URL” field. The dashboard’s API page generates this URL for you, ready to copy.

The key is validated the same way regardless of which method carries it, and a header takes priority if both are present. Since the query-param URL embeds a secret, treat it like a password: don’t paste it anywhere public, and prefer the Authorization header for any client that supports it (all REST calls, and MCP clients that let you set headers).

Key rotation

If a key is leaked:

1. Regenerate the key in the dashboard, the old key stops working immediately
2. Update your integration with the new key