# Authentication and quotas

- Anonymous trial: no key needed for REST or MCP. Limit per client IP: 30 requests/minute and 500/day (IP is used only hashed, to count; it is not logged).
- API keys (optional): send `Authorization: Bearer sgk_live_...` or `X-API-Key`. Keys are issued by the operator (server-side CLI), stored only as SHA-256 hashes, never shown in logs or pages. Demo keys (`sgk_demo_...`) only work on the demo deployment and production keys only on production (403 otherwise).
- A key that is sent but unknown/malformed returns 401 (not silently downgraded). Revoked keys return 403.
- Quotas are enforced by one Durable Object per client key, so counts are global across all Cloudflare locations, not per instance.
- Headers on every API/MCP response: `RateLimit-Policy`, `RateLimit` (remaining r and seconds to reset t of the tightest window), `X-RateLimit-Limit/Remaining/Reset` (minute window, reset in epoch seconds) and `X-RateLimit-*-Day`. 429 responses include `Retry-After` (seconds) and `error.retry_after_seconds`; wait that long before retrying.
- MCP: the same headers apply. OAuth is not implemented; clients that support custom headers can send the bearer key.
- No write operations exist. Admin statistics require a separate operator token and are disabled when none is configured.