Authentication
Authenticate requests with a SearchLeads API key.
Create a key in Developer → API Keys and enable the scope needed for your request. Send the full key in the x-searchleads-api-key header.
x-searchleads-api-key: sl_live_your_full_api_key_hereThe full key is shown once. The prefix displayed later in the dashboard cannot authenticate API or MCP calls. Keep keys in server-side secret storage; never commit them or expose them in browser code.
The same header authenticates search, capabilities, filter discovery, exports, and MCP.
API keys have search, export, and mcp scopes. Search and filter discovery require search; export creation and status require export; the hosted MCP server requires mcp. Enable only the scopes your client needs.
MCP connection permission does not grant search or export permission:
| Operation | Required key scopes |
|---|---|
| REST search / filter option lookup | search |
| REST export creation / status | export |
| MCP connection, capabilities, filter catalog | mcp |
MCP search_prospects / lookup_filter_options | mcp + search |
MCP preview_export / start_export / get_export_status | mcp + export |
To search and then export through MCP, enable all three scopes. A key with only mcp can connect and discover the service but cannot search, look up filter values, or export. Export creation uses an existing owned search_id; creating a new search first also requires search permission.
Authenticated capabilities return keyCapabilities.scopes and keyCapabilities.tools, including requiredScopes, missingScopes, and allowed. These describe the key's permissions; account feature access, credits, and job limits remain separate requirements. Public documentation capabilities do not describe a particular key.