> ## Documentation Index
> Fetch the complete documentation index at: https://metamanager.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> The checker is open. What signing in changes, and what is coming.

## The checker needs no credentials

```bash theme={null}
curl 'https://metamanager.dev/inspect?url=https://example.com'
```

There is no API key to obtain, no header to set, and no signup. This is
deliberate and not a trial: the single-page checker is free and stays free.

Requests are rate limited by IP. See [rate limits](/docs/operations/rate-limits).

## Signing in

Signing in is passwordless. You give an email address, we send a link, the link
signs you in. There is no password to remember and none to leak.

```bash theme={null}
curl -X POST https://metamanager.dev/auth/login \
  -H 'content-type: application/json' \
  -d '{"email":"you@example.com"}'
```

```json theme={null}
{ "ok": true, "message": "If that address can sign in, a link is on its way." }
```

<Note>
  That response is identical whether the address has an account or not. A
  different status or message would turn the login form into a way to test
  whether somebody uses MetaManager.
</Note>

The link is single-use and expires in fifteen minutes. Redeeming it sets a
session cookie — `HttpOnly`, `Secure`, `SameSite=Lax` — and the browser is
redirected so the token does not linger in history or a `Referer` header.

## What a session gets you

Sessions are for the web application. They raise your rate limit, move the
budget from your network to your account, and unlock saved URLs and projects.

```bash theme={null}
curl https://metamanager.dev/entitlements
```

```json theme={null}
{
  "plan": "anonymous",
  "label": "Anonymous",
  "checks_per_hour": 50,
  "saved_urls": 0,
  "projects": 0,
  "api": false
}
```

## Programmatic API access

Create an API key at [your keys](https://metamanager.dev/keys) and send it
as a bearer token:

```bash theme={null}
curl https://metamanager.dev/api/audits \
  -H "Authorization: Bearer mm_live_..."
```

A key authenticates the whole `/api` surface with no cookie, which is what lets
an agent or a script use MetaManager at all.

<Warning>
  **The key is shown once, when you create it.** Only a hash is stored, so we
  cannot show it to you again and cannot recover it for you. If you lose one,
  revoke it and create another.
</Warning>

### Read and write

A key is **read-only** unless you deliberately give it write access.

|                                                   | Read-only | Read & write |
| :------------------------------------------------ | :-------- | :----------- |
| Check pages, read audits, monitors and saved URLs | Yes       | Yes          |
| Start an audit, save a URL                        | —         | Yes          |

The distinction exists because starting an audit spends one of your monthly
audits. An agent working in a loop can exhaust a month's allowance in a minute
and, unlike a person, will not notice it happening — so that power is something
you hand over on purpose rather than by default.

### What each plan reaches

|                                          | Free | Pro |
| :--------------------------------------- | :--- | :-- |
| Keys                                     | 1    | 10  |
| `/inspect`, fix prompts, issue catalogue | Yes  | Yes |
| Audits, monitors, saved URLs             | —    | Yes |

A Free key is real and useful: it checks single pages at the Free rate of 100 an
hour. The heavier endpoints answer `402` with a message saying so.

### Rate limits follow the account

Every key on an account shares **one** hourly bucket, the same one your browser
uses. Creating more keys does not raise your limit — see
[Rate limits](/docs/operations/rate-limits).

### Revoking

Revoking takes effect immediately, and anything using that key stops working at
once. The key's record is kept, so you can still see that it existed and when it
was last used.

## Connecting an AI agent

If you want an agent to use MetaManager rather than writing code against it, use
the [MCP server](/docs/guides/mcp) — no code either way.

A client that speaks the MCP authorization spec needs **no key at all**: it sends
you to MetaManager to approve, you tick which permissions it gets, and it stores
and refreshes the credential itself. Clients that do not can use an API key as a
bearer token, exactly as above.

The two are independent. Approved connections are listed under
[connected agents](https://metamanager.dev/agents) and API keys under
[your keys](https://metamanager.dev/keys); revoking one leaves the other
working.