Macadress Authentication

generated: '2026-08-28'
method: searched
source: https://macadress.com/docs
docs:
- https://macadress.com/docs
- https://macadress.com/mcp
derived_from:
- openapi/macadress-openapi.yaml
summary:
  model: static API key
  types:
  - http
  - apiKey
  api_key_in:
  - header
  - query
  - body
  key_prefix: mk_
  oauth: false
  oidc: false
  mtls: false
  signup: https://macadress.com/signup
  provisioning: >
    Instant and self-serve. A free key is created the moment an account is created, with no
    approval step, and is visible any time on the account page. Only the browser lookup tool
    on macadress.com is usable without a key; the REST API and the MCP server both require one.
schemes:
- name: apiKeyHeader
  type: http
  scheme: bearer
  in: header
  header: Authorization
  format: 'Authorization: Bearer mk_...'
  applies_to: all operations
  preferred: true
  sources:
  - openapi/macadress-openapi.yaml
  - https://macadress.com/docs
- name: apiKeyQuery
  type: apiKey
  in: query
  parameter: api_key
  format: '?api_key=mk_...'
  applies_to: all operations
  preferred: false
  caution: >
    A key in the query string is written into proxy logs, server access logs, browser
    history and Referer headers. Documented as a convenience, not the recommended transport.
  sources:
  - openapi/macadress-openapi.yaml
  - https://macadress.com/docs
- name: apiKeyBody
  type: apiKey
  in: body
  parameter: api_key
  applies_to: [lookupMACBatch]
  format: 'an "api_key" field alongside "macs" in the JSON body'
  declared_in_openapi: true
  openapi_location: paths./v1/mac/batch.post.requestBody.content.application/json.schema.properties.api_key
  note: >
    Documented as a third transport and present as a request-body property, but not modelled
    as a securityScheme (OpenAPI cannot express a body-borne credential as one). A strict
    spec-driven client will not know it exists.
  sources:
  - https://macadress.com/docs
anonymous_operations:
- operationId: healthz
  path: /v1/healthz
  openapi_declaration: 'security: []'
  note: Liveness only. Not counted against any quota.
unauthenticated_behaviour:
  status: 401
  body: '{"error": "missing API key: pass it as \"api_key\" (query param or POST body) or an Authorization: Bearer header"}'
  www_authenticate_header: false
  observed_live: '2026-08-28'
  note: >
    The 401 body names all three accepted transports, which is unusually helpful. No
    WWW-Authenticate challenge is emitted, so a client cannot negotiate the scheme from the
    response alone.
mcp_authentication:
  endpoint: https://mcp.macadress.com/mcp
  scheme: http bearer, same mk_ key as REST
  oauth: false
  probed: '2026-08-28 POST tools/list -> 401 "no bearer token"'
  provider_rationale: >
    Stated on https://macadress.com/mcp: MCP's authorization spec is optional for HTTP
    transports, and the provider chose a spec-legal bearer token over standing up a full
    OAuth 2.1 authorization server with PKCE and dynamic client registration. Consequence
    for agents: no one-click "connect your account" flow, and no
    /.well-known/oauth-protected-resource to discover.
key_management:
  rotation_policy: not published
  scopes: none
  multiple_keys: not published
  revocation: not published
  gap: >
    No published guidance on rotating, revoking or issuing multiple keys, and no scope or
    permission model — one key carries the account's full read surface and its whole
    billing quota. For an agent deployment that is the practical blast radius: a leaked key
    cannot be narrowed, only replaced.