Difficat Com Authentication

generated: '2026-11-05'
method: searched
source: https://difficat.com/llms.txt
docs: https://difficat.com/agents
docs_additional:
- https://difficat.com/llms.txt
derived_from: openapi/difficat-com-openapi.yml
summary:
  types:
  - apiKey
  - http
  api_key_in:
  - header
  unauthenticated_allowance: true
  note: 'No credential is required for the one-time free allowance (40 comparison pages, 5 page
    discoveries and 5 screenshots per client address). Beyond it a call is paid by prepaid key, Pro
    account key, or per call over HTTP 402 (Machine Payments Protocol / x402). Keys are only obtained
    by a signed-in human at https://app.difficat.com/account: "no call obtains a key without an account".'
schemes:
- name: payment
  type: http
  scheme: Payment
  description: 'Machine Payments Protocol (mpp.dev). A first request without a credential is answered
    with 402 and a WWW-Authenticate: Payment challenge; the paid retry carries Authorization: Payment
    <credential>. Successful responses carry a Payment-Receipt header. x402 clients are accepted on the
    same routes for USDC on Base. Over MCP the challenge is JSON-RPC error -32042 and the credential
    travels in _meta["org.paymentauth/credential"].'
  sources:
  - openapi/difficat-com-openapi.yml
  - https://difficat.com/llms.txt
- name: prepaidKey
  type: http
  scheme: bearer
  key_prefix: dck_
  description: 'A prepaid key (dck_…) from the account page at /account, where a signed-in human tops
    up by card through Stripe Checkout and copies the key. Sent as Authorization: Bearer dck_…; on MCP a
    gateway that cannot set Authorization may send it as X-DiffiCat-Key. An insufficient balance answers
    402, an unknown key 401.'
  alternate_header: X-DiffiCat-Key
  sources:
  - openapi/difficat-com-openapi.yml
  - https://difficat.com/llms.txt
- name: proKey
  type: http
  scheme: bearer
  description: A Pro account's API key draws on the 5,000 captured pages a month included in Pro, with
    overage billed up to a cap set on the account page.
  sources:
  - https://difficat.com/llms.txt
- name: jobToken
  type: http
  scheme: bearer
  description: The one-time jobToken returned when the job or screenshot was created, used on job reads
    (GET /jobs/{id}, report, files, cancel). The prepaid key that paid a job is accepted in its place.
  sources:
  - openapi/difficat-com-openapi.yml
- name: shareToken
  type: http
  scheme: bearer
  key_prefix: dcs_
  description: A share token (dcs_…) a snapshot's owner issued in the web app. It reads that one snapshot
    and starts live compares against it; it never lists, manages or pays.
  sources:
  - openapi/difficat-com-openapi.yml
- name: shareTokenHeader
  type: apiKey
  in: header
  parameter: X-DiffiCat-Share
  description: The same share token, sent beside a paying Authorization credential on the two compare
    routes.
  sources:
  - openapi/difficat-com-openapi.yml