# Authentication

## Short version

You probably do not need to authenticate. Anonymous requests to
`POST https://api.removellmwatermark.com/v1/clean` and `/v1/detect`, and to the MCP server at
`https://api.removellmwatermark.com/mcp`, are allowed at 20 calls a day per IP with up to 10,000
characters per call. That is enough to check a document.

## When you do need a key

Higher daily limits, longer inputs (up to 200,000 characters), and a per-minute
rate limit you can rely on.

## Getting one

There is no automated agent-registration endpoint, and no OAuth authorization
server, because this API does not issue tokens. A human creates the key:

1. Sign in with Google at https://removellmwatermark.com/login.
2. Subscribe to a plan that includes API access (https://removellmwatermark.com/pricing).
3. Create a key at https://removellmwatermark.com/account. The secret is displayed once.

## Using one

Send it as a header on every request:

```http
x-api-key: rlw_...
```

The same header works for the MCP endpoint.

## Errors

- `401 invalid_api_key`: the key is wrong, revoked or disabled.
- `402` with `code: "daily_quota"` or `"api_not_on_plan"`. The response carries an `upgradeUrl`.
- `429`: per-minute rate limit. Retry after a short pause.

Every response is `{ ok: true, data }` or `{ ok: false, error: { code, message } }`,
so you never have to guess whether you are holding data or an error.

## What we store

Counts and code-point classes, for usage numbers. Not the text you send, not a
fragment of it, not a hash of it. Scan records are deleted after 90 days.