Authentication

iTechSmart exposes three public service endpoints, each with its own authentication model. This page documents exactly how each one authenticates requests, verified against the live services.

Service	Base URL	Auth
API Gateway	api.itechsmart.dev	`x-api-key` header — optional (free tier works without a key)
MCP Server	mcp.itechsmart.dev	`Authorization: Bearer <key>` — required for tool calls
Public Ledger	verify.itechsmart.dev	None — fully public, read-only

API Gateway (api.itechsmart.dev)

The gateway authenticates with an API key passed in the x-api-key request header. Keys look like itsk_<tier>_<random>. Requests without a key are accepted and served on the anonymous free tier, so you can try every core endpoint before you have a key:

# No key — anonymous free tier
curl https://api.itechsmart.dev/v1/health

# With a key
curl -H "x-api-key: itsk_partner_YOUR_KEY" https://api.itechsmart.dev/v1/ledger?limit=5

Tiers and rate limits

Limits are enforced per key (or per anonymous caller) per day:

Tier	Requests / day	`/v1/classify` calls / day
Free (no key or free key)	100	10
Partner	1,000	100
Enterprise	10,000	1,000

Exceeding a limit returns 429 with a body like {"detail": "Rate limit exceeded (100/day)"}. An unknown key returns 401 with {"detail": "Invalid API key. Get one at itechsmart.dev/api"}.

Getting a key

Keys are issued by iTechSmart. Partner and enterprise keys are provisioned through POST /v1/keys/generate, which itself requires an admin-tier key — it is not self-serve. To request a key, contact [email protected] or use the contact options on itechsmart.dev.

MCP Server (mcp.itechsmart.dev)

The MCP server is fail-closed: every tool call and SSE session requires a valid API key, passed either as a Bearer token or as an api_key query parameter:

# Bearer header (recommended)
curl -N -H "Authorization: Bearer YOUR_MCP_KEY" https://mcp.itechsmart.dev/sse

# Query parameter (for clients that cannot set headers)
curl -N "https://mcp.itechsmart.dev/sse?api_key=YOUR_MCP_KEY"

Authentication happens at SSE connect time — an invalid or missing key is rejected before any tool is reachable. Keys carry scopes: full keys can invoke all 66 tools, while read-only audit-scope keys are limited to the prooflink.*, mission.* and compliance.* tools (designed for auditors and CISO workflows). Rate limits: 60 requests/minute per key, 10/minute for simulate_infrastructure_attack. See the MCP Server reference for connection guides.

Two MCP endpoints are deliberately public (no auth): GET /health and the A2A agent card at GET /.well-known/agent.json. The A2A JSON-RPC endpoint POST /a2a uses the same Bearer keys as MCP.

Unauthenticated (public) endpoints

The following read-only surfaces require no credentials at all, by design — the ledger is only useful if anyone can verify it:

All of verify.itechsmart.dev — receipts, chain verification, stats (see the ProofLink API)
GET api.itechsmart.dev/v1/health, /v1/ledger, /v1/receipt/{id}, /v1/compliance — usable on the anonymous free tier
GET mcp.itechsmart.dev/health and /.well-known/agent.json

Security notes

All endpoints are HTTPS-only. Never send a key over plain HTTP.
Keys are secrets — do not embed them in client-side JavaScript or public repositories.
Prefer the Bearer header over the ?api_key= query parameter where possible; query strings are more likely to end up in logs.
Every authenticated action on the MCP server seals a ProofLink receipt to the public ledger, so key activity is independently auditable.