Authentication

Documentation index for AI agents: /llms.txt. Every page is also available as markdown: add .md to the URL.

API keys, the x-api-key header, MCP bearer auth and keeping keys secret.

REST API: x-api-key header

Every data endpoint needs an API key in the x-api-key header:

curl "https://use.apiindonesia.id/api/v1/libur/upcoming" \
  -H "x-api-key: aip_live_xxx"

Create keys in the dashboard at dashboard.apiindonesia.id under API Keys. Keys start with aip_live_. A missing or invalid key returns 401 (see Errors).

MCP server: Authorization header

The MCP server at https://mcp.apiindonesia.id/mcp takes the same API key as a bearer token:

Authorization: Bearer aip_live_xxx

See MCP server and agents for client setup.

Keep keys secret

Treat a key like a password. Do not commit it, paste it into shared files or expose it in browser code. If a key leaks, create a new one in the dashboard and delete the old one.

Account endpoints

The dashboard itself uses these endpoints. Endpoints under /user and /billing (and /auth/me) take a dashboard session token as Authorization: Bearer, not an API key. Most integrations never need them.