Get started
Authentication
Bolsix supports two authentication paths: OAuth for the hosted MCP server and API keys for REST or local MCP clients.
Hosted MCP: OAuth
Compatible clients discover the protected resource, open a browser login, and request the read scope. Bolsix verifies the token audience and maps the identity to an account key automatically.
claude mcp add --transport http bolsix https://mcp.bolsix.io/REST: Bearer API key
Send the key in the Authorization header, or in an X-API-Key header. Query-string tokens are accepted for compatibility, but headers are recommended because URLs are commonly logged.
Authorization: Bearer bx_live_...Rate limits
Each API key has a daily request quota — 1,000 requests on the free plan — that resets at 00:00 UTC. Every authenticated response reports where you stand; once the quota is spent, requests return 429 with a Retry-After header until the reset.
X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 997
X-RateLimit-Reset: 1790208000Errors
| 401 | Missing, invalid, or inactive API key |
| 403 | Authenticated identity is disabled |
| 404 | Resource or requested dataset was not found |
| 422 | A parameter failed schema validation |
| 429 | The key's daily request quota is spent; retry after the reset |
| 502 | An upstream source such as BCB is temporarily unavailable |