Authentication
Every scanr.ai API request is authenticated with an API token. You create tokens in your account dashboard and send one with every request.
API access is a paid add-on
You need an active API plan (Starter, Power User or Business) before you can create a token. If you don't see the API Tokens page, pick a plan on API pricing.
Tokens work only while that plan is active. If it is canceled or expires, or a payment fails, every token answers 403 with a message saying the API plan is inactive. The tokens aren't deleted: renew the plan and they work again.
Create a token
- Sign in to scanr.ai.
- Go to Account → API Tokens.
- Click Create token, give it a name you'll recognize later (
nightly-screen,research-agent), pick its scopes, and optionally set an expiry date. - Copy the token. It is shown once. scanr.ai stores only a hash, so a lost token cannot be recovered; create a new one instead.
Tokens look like scanr_ followed by 64 hex characters:
Scopes
A new token gets read unless you ask for more. Give each integration only the scopes it uses.
Send the token
Send the token in the Authorization header as a bearer token. The REST API also accepts it in an X-API-Key header; the MCP server accepts only Authorization: Bearer.
Every example in these docs reads the token from a SCANR_API_TOKEN environment variable:
Personal data access
Some endpoints read or change data that belongs to your account: running a scan (each run is recorded in your scan history), saved scans, their performance and alerts. You can switch off API-token access to that data under account settings. While it is off, those endpoints answer 403 with a message saying personal data access is disabled, and the MCP server's scan tool returns the same message as a tool error; market data and reference endpoints, and the other MCP tools, keep working.
Manage tokens
From Account → API Tokens you can:
- List tokens with their prefix, scopes, status, last-used time and expiry.
- Rename a token.
- Revoke a token. It stops working on its next request; the record and its usage history are kept.
- Delete a token permanently.
Usage per token is under Account → API Usage.
Security
- Never commit a token to source control or paste it into a shared prompt. Use an environment variable or a secrets manager.
- One token per integration, so a leak means rotating one integration, not all of them.
- Set an expiry on experimental or short-lived tokens.
- Scope down. An integration that only reads data doesn't need
write. - Revoke immediately if a token appears in logs, a screenshot or a repository.
- Give agents their own token. An AI agent with a token can spend your rate limits and AI credits; a dedicated token makes its usage visible and easy to cut off.