Skip to main content
This page covers how the REST API, MCP, and CLI authenticate, what they cost, and their rate limits.

​
Authentication

The REST API, MCP, and CLI all share the same credential scheme.
  • API Key: a Bearer token in the form {id}.{secret}. Works across REST, MCP, and the CLI.
  • JWT: MCP also accepts a JWT issued through OAuth (for conversational AI clients).
You can authenticate with a valid API Key or token regardless of the sign-in method you registered with. For details on issuing and using keys, see Authentication.

​
Who issues keys

You can issue an account API key from platform.tiro.ooo/me/api-keys on any plan. It acts with your permissions in every workspace you can currently access. Only the relevant workspace or organization admin can issue a workspace or organization API key.

​
What’s free and what’s paid

Reading notes, folders, share links, document templates, transcripts, and word memory costs no credits.
Wiki endpoints require a paid plan. A personal workspace needs Pro or higher, and a team workspace needs Team or higher. Calling them on a plan without access returns 402 Payment Required.
The wiki gate applies the same way to REST and MCP (MCP search_wiki, get_wiki_page, list_wiki_mentions, get_wiki_graph).
Charges for speech recognition (STT) and bulk LLM processing don’t yet apply through the API or MCP.

​
Rate limit

A single API Key can send up to 600 requests per 60 seconds. Go over that and you get 429 Too Many Requests, with Retry-After and X-RateLimit-* headers in the response telling you when to try again. For the full response format, see Error handling.