Authentication
Two credentials, one account. An API key authenticates the query endpoints. Your signed-in session authenticates the API Console and the endpoints behind it.
01Two credentials
| Credential | Accepted by | How it is sent |
|---|---|---|
| API key | POST /api/query and POST /api/query/stream | Authorization: Bearer ra-…, or X-Api-Key: ra-… |
| Session cookie | The API Console and /api/console/* | The auth_token cookie, set when you sign in to ResearchAnything |
Neither works in the other's place. An API key is not accepted on /api/console/*, so keys, usage and timelines cannot be managed with a key. The session cookie is not accepted on the query endpoints.
02API keys
Keys are created in the API Console at researchanything.ai/console/keys. Any signed-in ResearchAnything account can create them. See API keys for creating and revoking them.
A key acts as your account. Calls made with it use your plan's monthly research runs and are recorded against your account.
Format
A key is ra- followed by 32 URL-safe characters (24 random bytes). The full key is shown once, when you create it. ResearchAnything stores only its SHA-256 hash, plus the first 12 characters as a prefix so you can tell keys apart in the Console. A lost key cannot be recovered: create a new one and revoke the old one.
Sending the key
Send the key as a Bearer token. The X-Api-Key header is also accepted. If the request has an Authorization: Bearer value, that is the key used; otherwise X-Api-Key is read.
curl https://researchanything.ai/api/query \
-H "Authorization: Bearer $ESSARION_KEY" \
-H "Content-Type: application/json" \
-d '{"query": "What is the half-life of caffeine in adults?"}'curl https://researchanything.ai/api/query \
-H "X-Api-Key: $ESSARION_KEY" \
-H "Content-Type: application/json" \
-d '{"query": "What is the half-life of caffeine in adults?"}'Key status and failures
A key is active until you revoke it, and revoked after. Revoking takes effect on the next call, and a revoked key cannot be reactivated. Keys have no expiry date.
| Situation | HTTP | Error code |
|---|---|---|
| No key sent | 401 | missing_api_key |
Unknown key, or one that does not start with ra- | 401 | invalid_api_key |
| Revoked key | 403 | key_inactive |
On /api/query/stream the same failures arrive as an error event and a final event on an HTTP 200 stream. See Errors.
03Session cookie
Signing in to ResearchAnything, with email and password or with your Essarion ID, sets an HTTP-only cookie named auth_token that holds a signed session token. It expires after a few days (seven by default); sign in again to get a new one. The API Console and every /api/console/* endpoint read this cookie.
Writes that carry the cookie (POST and DELETE) are refused with HTTP 403 and the code CROSS_SITE_REQUEST when a browser marks them as coming from another site.