# SVG AI authentication

> Connect to the SVG AI REST API and MCP server. Base URL: https://www.svgai.org.

## Choose an authentication method

Use an SVG AI API key for REST requests. MCP clients can use OAuth through the user's browser or an API key in a request header. Generation and vectorization remain authenticated operations.

## API keys

Sign in to the [API and MCP console](https://www.svgai.org/dashboard/api) to create a key. The full key is shown once, when created. Keys can be revoked from the same console.

Send either of these request headers, replacing the placeholder with your own key:

```http
Authorization: Bearer YOUR_API_KEY
```

```http
x-api-key: YOUR_API_KEY
```

Credentials belong in request headers, never URL query parameters. Keep keys out of public source code, shared prompts and logs.

## MCP OAuth

Add `https://www.svgai.org/api/mcp` to an OAuth-capable MCP client. The initial unauthenticated request returns HTTP 401 with a Bearer `resource_metadata` challenge. Follow the client's browser sign-in and consent flow.

- [Protected-resource metadata](https://www.svgai.org/.well-known/oauth-protected-resource) identifies the MCP resource and its authorization server.
- [Authorization-server metadata](https://www.svgai.org/.well-known/oauth-authorization-server) supplies the authorization, token and client-registration endpoints.
- The authorization-code flow uses PKCE with S256. The metadata advertises the `mcp` and `offline_access` scopes; the latter supports continuing access with refresh tokens.
- Connected apps can be disconnected in the [console](https://www.svgai.org/dashboard/api).

Use the metadata to configure a compatible client, then complete sign-in and consent in the browser.

MCP OAuth access tokens are not accepted by the REST API. REST requests, including generation polling, require an API key from the same SVG AI account. If an MCP generation is still processing and returns a REST polling URL, use that account's API key to retrieve the existing result; do not submit another generation to recover it.

## Credits and access

Sign up to get starter credits for the website. API and MCP generation and vectorization require paid access and available credits; website starter credits do not unlock paid API use. Authentication by itself does not grant paid access.

Call authenticated `GET /api/v1/credits` or the MCP `get_credits` tool to check account access, balance and current operation costs before generating or vectorizing. See [pricing](https://www.svgai.org/pricing) for current plans.

## Errors and recovery

- HTTP 401: connect or sign in with valid credentials. For MCP, use the Bearer resource-metadata challenge to discover OAuth.
- HTTP 402 with `payment_required` or `insufficient_credits`: the account owner needs to resolve paid access or available credits.
- HTTP 429: wait before retrying; REST errors may include `retry_after_seconds`.

REST handler errors contain `error.type` and `error.message`; MCP uses JSON-RPC errors and tool results. A processing generation has a polling URL. Check that accepted generation before repeating a creation request, because creation requests are not idempotent.

## References

- [API and MCP documentation](https://www.svgai.org/docs): task selection, complete examples, polling and errors.
- [OpenAPI specification](https://www.svgai.org/openapi.json): REST request and response contract.
- [Agent guide](https://www.svgai.org/llms.txt): generation versus vectorization and public product links.
- [Support](https://www.svgai.org/contact): help with account or developer access.