Skip to main content

​
The checker needs no credentials

There is no API key to obtain, no header to set, and no signup. This is deliberate and not a trial: the single-page checker is free and stays free. Requests are rate limited by IP. See rate limits.

​
Signing in

Signing in is passwordless. You give an email address, we send a link, the link signs you in. There is no password to remember and none to leak.
That response is identical whether the address has an account or not. A different status or message would turn the login form into a way to test whether somebody uses MetaManager.
The link is single-use and expires in fifteen minutes. Redeeming it sets a session cookie — HttpOnly, Secure, SameSite=Lax — and the browser is redirected so the token does not linger in history or a Referer header.

​
What a session gets you

Sessions are for the web application. They raise your rate limit, move the budget from your network to your account, and unlock saved URLs and projects.

​
Programmatic API access

Create an API key at your keys and send it as a bearer token:
A key authenticates the whole /api surface with no cookie, which is what lets an agent or a script use MetaManager at all.
The key is shown once, when you create it. Only a hash is stored, so we cannot show it to you again and cannot recover it for you. If you lose one, revoke it and create another.

​
Read and write

A key is read-only unless you deliberately give it write access. The distinction exists because starting an audit spends one of your monthly audits. An agent working in a loop can exhaust a month’s allowance in a minute and, unlike a person, will not notice it happening — so that power is something you hand over on purpose rather than by default.

​
What each plan reaches

A Free key is real and useful: it checks single pages at the Free rate of 100 an hour. The heavier endpoints answer 402 with a message saying so.

​
Rate limits follow the account

Every key on an account shares one hourly bucket, the same one your browser uses. Creating more keys does not raise your limit — see Rate limits.

​
Revoking

Revoking takes effect immediately, and anything using that key stops working at once. The key’s record is kept, so you can still see that it existed and when it was last used.

​
Connecting an AI agent

If you want an agent to use MetaManager rather than writing code against it, use the MCP server — no code either way. A client that speaks the MCP authorization spec needs no key at all: it sends you to MetaManager to approve, you tick which permissions it gets, and it stores and refreshes the credential itself. Clients that do not can use an API key as a bearer token, exactly as above. The two are independent. Approved connections are listed under connected agents and API keys under your keys; revoking one leaves the other working.