Get started

Authentication

Bolsix supports two authentication paths: OAuth for the hosted MCP server and API keys for REST or local MCP clients.

Hosted MCP: OAuth

Compatible clients discover the protected resource, open a browser login, and request the read scope. Bolsix verifies the token audience and maps the identity to an account key automatically.

claude mcp add --transport http bolsix https://mcp.bolsix.io/

REST: Bearer API key

Send the key in the Authorization header, or in an X-API-Key header. Query-string tokens are accepted for compatibility, but headers are recommended because URLs are commonly logged.

Authorization: Bearer bx_live_...

Rate limits

Each API key has a daily request quota — 1,000 requests on the free plan — that resets at 00:00 UTC. Every authenticated response reports where you stand; once the quota is spent, requests return 429 with a Retry-After header until the reset.

X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 997
X-RateLimit-Reset: 1790208000

Errors

401Missing, invalid, or inactive API key
403Authenticated identity is disabled
404Resource or requested dataset was not found
422A parameter failed schema validation
429The key's daily request quota is spent; retry after the reset
502An upstream source such as BCB is temporarily unavailable
Bolsix Docs — B3 data for agents