Sign in to the dashboard to create a key, then configure your client to send Authorization: Bearer <API_KEY> on every MCP request. X-API-Key is also accepted. A dashboard session cookie is not enough.
The key must be active, unexpired and have the convert scope. Unrestricted keys (an empty scope list) also work. Revoking a key blocks subsequent requests. There is currently no OAuth browser-login flow; clients that only support OAuth cannot connect directly.
The same conversion engine, organization credits and conversion logs are used by REST and MCP. MCP requests also have API-key rate limits, including discovery requests. Successful non-sandbox conversions consume one credit. For a free test, explicitly set sandbox: true; PDF output is watermarked.