---
title: smry authentication for agents
description: Anonymous public reading and personal-key authentication for account tools.
canonical: https://smry.ai/auth.md
last-updated: 2026-08-29
---

# smry authentication for agents

## Discover

The public reader at https://r.smry.ai is anonymous and needs no registration,
claim, login, cookie, API key, or delegated user permission. The Developer API
and MCP server operate on user-owned data and require a personal smry key.

## Pick a method

Use anonymous public reading for source retrieval. Use a personal `smry_` key
only when the user asks to access their private smry library, history, notes,
highlights, feeds, files, or monitors through MCP or the Developer API.

## Register

The user creates a revocable personal key at
https://smry.ai/mcp-api-cli?view=keys. There is no unattended registration URI
and an agent must not fabricate one or register an account without the user.

## Claim

There is no claim or identity-assertion step for the anonymous reader. A
personal key represents the smry account that created it; possession is not
permission to share it, expose it in logs, or persist it insecurely.

## Use the credential

Send the personal key only to https://api.smry.ai as
`Authorization: Bearer <key>`. Store it in `SMRY_API_KEY` or another protected
credential store. Never put a key in a URL, browser bundle, repository, prompt,
or source document.

## Errors

A 401 means the key is missing, invalid, or revoked. A 403 can indicate an
ineligible plan or owner boundary and must not be worked around. A 429 includes
`Retry-After`; wait before retrying instead of looping.

## Revocation

Revoke personal keys at https://smry.ai/mcp-api-cli?view=keys. Anonymous
reader access has no credential to revoke. Canonical installation and MCP
setup instructions are at https://smry.ai/agent-setup/prompt.md.