---
url: https://ora.ai/docs/authentication
title: "Authentication & rate limits - Docs"
description: "Keyless reads, HATCHA agent verification for writes, scan API keys, per-IP quotas, and the Retry-After contract."
crawled_at: 2026-10-18T19:27:04Z
ask: https://ora-ai.ora.run/ask
docs: https://ora-ai.ora.run/.well-known/ora/docs
lang: en
---
# Authentication & rate limits

Every read endpoint is open: no API key, no signup, service accounts and bots fully supported. Write operations (product feedback) are agent-only and verified through HATCHA, a reverse CAPTCHA that proves the caller is an agent.

Keyless by default

Read endpoints are rate-limited by IP. Scans allow a burst of 10 per minute, plus durable daily quotas: 30 scans per rolling 24 hours and 6 force (cache-bypassing) scans per rolling 24 hours. Responses served from the freshness cache never consume quota.

Scan API keys

Callers holding an ora-issued scan API key (issued manually -

contact ora · ) present it as · Authorization: Bearer <key>

on the scan endpoints (POST /api/scan/checks included) or the MCP scan_domain and run_checks tools and are exempt from all scan-family rate limits. An unrecognized bearer token is never an error; it simply falls back to the per-IP tier.

Backing off

When rate-limited, the API returns HTTP 429 with a JSON body and a Retry-After header carrying the seconds until your window frees up. Back off and retry after that interval. The full authentication walkthrough lives at

/auth.md

.

# Footer

The standard for agent experience.

© 2026 [era labs](https://eralabs.ai/)

Product

- Scan a site

- [Journey](https://journey.ora.ai/)

- [WebMCP audit](https://webmcp.ora.ai/)

- [Directory](https://directory.ora.ai/)

Resources

- Methodology

- Research

- Blog

- API Docs

Company

- About

- Contact

- Privacy

- [@oradotai](https://x.com/oradotai)