# SVG AI authentication

> Connect to the SVG AI REST API and MCP server. Base URL: https://www.svgai.org.

## Choose an authentication method

Use an SVG AI API key for REST requests. MCP clients can use OAuth through the user's browser or an API key in a request header. Generation and vectorization remain authenticated operations.

## API keys

Sign in to the [API and MCP console](https://www.svgai.org/dashboard/api) to create a key. The full key is shown once, when created. Keys can be revoked from the same console.

Send either of these request headers, replacing the placeholder with your own key:

```http
Authorization: Bearer YOUR_API_KEY
```

```http
x-api-key: YOUR_API_KEY
```

Credentials belong in request headers, never URL query parameters. Keep keys out of public source code, shared prompts and logs.

## MCP OAuth

Add `https://www.svgai.org/api/mcp` to an OAuth-capable MCP client. The initial unauthenticated request returns HTTP 401 with a Bearer `resource_metadata` challenge. Follow the client's browser sign-in and consent flow.

- [Protected-resource metadata](https://www.svgai.org/.well-known/oauth-protected-resource) identifies the MCP resource and its authorization server.
- [Authorization-server metadata](https://www.svgai.org/.well-known/oauth-authorization-server) supplies the authorization, token and client-registration endpoints.
- The authorization-code flow uses PKCE with S256. The metadata advertises the `mcp` and `offline_access` scopes; the latter supports continuing access with refresh tokens.
- Connected apps can be disconnected in the [console](https://www.svgai.org/dashboard/api).

Use the metadata to configure a compatible client, then complete sign-in and consent in the browser.

## Credits and access

Sign up to get starter credits for the website. API and MCP generation and vectorization require paid access and available credits; website starter credits do not unlock paid API use. Authentication by itself does not grant paid access.

Call authenticated `GET /api/v1/credits` or the MCP `get_credits` tool to check account access, balance and current operation costs before generating or vectorizing. See [pricing](https://www.svgai.org/pricing) for current plans.

## Errors and recovery

- HTTP 401: connect or sign in with valid credentials. For MCP, use the Bearer resource-metadata challenge to discover OAuth.
- HTTP 402 with `payment_required` or `insufficient_credits`: the account owner needs to resolve paid access or available credits.
- HTTP 429: wait before retrying; REST errors may include `retry_after_seconds`.

REST handler errors contain `error.type` and `error.message`; MCP uses JSON-RPC errors and tool results. A processing generation has a polling URL. Check that accepted generation before repeating a creation request, because creation requests are not idempotent.

## References

- [API and MCP documentation](https://www.svgai.org/docs): task selection, complete examples, polling and errors.
- [OpenAPI specification](https://www.svgai.org/openapi.json): REST request and response contract.
- [Agent guide](https://www.svgai.org/llms.txt): generation versus vectorization and public product links.
- [Support](https://www.svgai.org/contact): help with account or developer access.