Authentication & API Keys

Authentication Overview

The Meridian Ephemeris API supports two authentication modes:

1. End-user JWT (Supabase) via the standard bearer token header:

Authorization: Bearer <jwt_token>

2. API key via the X-API-Key header:

X-API-Key: <api_key>

Creating API Keys

1. Sign in to your dashboard
2. Navigate to API Keys
3. Click "Create API Key"
4. Give your key a descriptive name (e.g., "Production", "Development")
5. Copy the key immediately—you won't see it again

Best Practices

Keep Keys Secret

• Never commit API keys to version control
• Use environment variables or secrets managers
• Don't expose keys in client-side code

// ✅ Good: Use environment variables
const apiKey = process.env.ASTROMCP_API_KEY;

// ❌ Bad: Hardcoded key
const apiKey = "<secret>";

Use Separate Keys for Environments

Create different keys for development, staging, and production. This allows you to:

• Revoke a compromised key without affecting all environments
• Track usage per environment
• Apply different rate limits if needed

Rotate Keys Regularly

For production systems, consider rotating API keys periodically:

1. Create a new key
2. Update your application to use the new key
3. Verify the new key works
4. Revoke the old key

Revoking Keys

To revoke an API key:

1. Go to API Keys
2. Find the key you want to revoke
3. Click "Revoke"

Revoked keys immediately stop working. This action cannot be undone.

Rate Limiting

Rate limits depend on your authentication mode and plan. See Error Codes & Rate Limits.

Security Headers

For additional security, include these headers in your requests:

Authorization: Bearer <jwt_token>
Content-Type: application/json
X-Request-ID: unique-request-id

The X-Request-ID header is optional but helps with debugging and support requests.