BC Data docsAuthentication
How API keys work for the BC Data REST API and MCP server, and how sign in works on the website.
Keys
Programs authenticate with an API key. Send it in the Authorization header:
Authorization: Bearer bcd_your_key_hereThe x-api-key header is accepted too, for clients that can only send that one.
- Keys are made on your account page. The full key is shown once, when you make it.
- We store only a hash. If you lose a key, revoke it and make another.
- You can have up to 5 active keys. Each key has its own allowance, so a second key is a second allowance. See Rate limits.
- A revoked key stops working at once.
- Never put a key in a web page or an app you hand to other people. Anyone who has it spends your allowance.
What needs a key
| Needs a key | Public |
|---|---|
/mcp, including initialize and tools/list | GET /v1, GET /v1/openapi.json, GET /v1/sources |
/v1/tools and every tool under it | GET /health, GET /stats.json, GET /status |
GET /v1/usage |
A call without a valid key to /mcp gets HTTP 401 with WWW-Authenticate: Bearer realm="bc-data" and a JSON-RPC error that says where to sign up. A REST call without a key gets 401 with the usual error shape.
Signing in on the website
The website uses a one time email code, with no passwords. After you enter the code, a session cookie keeps you signed in for 30 days. The cookie is for the account pages only. The data API ignores cookies, so a key is the only way in for programs.
Account changes (your name, the B.C. resident answer, making and revoking keys, asking for higher limits) need that session. A key cannot change an account.