Radar API / Developer guide
Authentication & keys
Keep credentials on the server and replace them safely.
Read as MarkdownHeaders and storage
REST uses X-API-Key. MCP accepts X-API-Key or Authorization: Bearer. Keep RADAR_API_KEY in an environment or managed secret store. API keys never belong in public bundles, analytics, support messages, URLs or persisted browser storage.
Create and replace
Keys are managed in the existing account. Give each integration a useful label. Copy the complete key at creation; later listings expose only its prefix. To rotate, create a replacement, update your server secret, verify one request, then revoke the old key. Revocation stops clients using that key; it does not create a replacement automatically.
Failures
401 missing_api_key, invalid_api_key or revoked_api_key requires checking the configured header or replacing the key. 403 access errors require checking account status. Do not retry authentication failures in a loop.