​

API Key Flow

​

When to use it

• Your agent needs autonomous, long-lived access to Encrata’s lookup APIs
• You want zero-friction operation - authenticate once, operate indefinitely
• Your agent runs on any platform - MCP servers, custom scripts, LLM integrations, orchestration frameworks

​

How it works

1. Agent hits the login endpoint with user credentials
2. Encrata returns a session token
3. Agent creates a named API key using the session token
4. Agent uses the API key as a Bearer token for all subsequent calls
5. API key doesn’t expire agent operates indefinitely until revoked

​

Step 1: Authenticate

POST https://encrata.com/api/auth/login
Content-Type: application/json

{
  "email": "user@example.com",
  "password": "password123"
}

{
  "token": "eyJhbGciOiJIUzI1NiIs...",
  "user": {
    "id": "usr_...",
    "email": "user@example.com"
  }
}

​

Step 2: Create an API key

POST https://encrata.com/api/keys
Authorization: Bearer <session_token>
Content-Type: application/json

{
  "name": "my-agent-key"
}

{
  "key": "enc_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "name": "my-agent-key",
  "created_at": "2026-05-26T10:00:00Z"
}

​

Step 3: Operate

POST https://encrata.com/api/agent/lookup
Authorization: Bearer enc_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Content-Type: application/json

{
  "email": "target@example.com"
}

​

What you get

• Immediate access - no approval workflow, no waiting
• All endpoints - email, phone, IP, domain, company, Google, dark web, username
• Credit-based - each lookup deducts from your balance
• No expiration - keys stay valid until explicitly revoked

​

Credential lifecycle

​

Errors

​

Security considerations

• Store keys securely treat API keys as secrets, never commit to source control
• Use named keys create descriptive names so users can identify and revoke agent keys
• Monitor usage agents should check credits periodically to avoid unexpected failures
• Handle revocation gracefully if a 401 is received on a previously-working key, the agent should notify the user rather than attempting to re-create keys