API Keys
Your API key authenticates all requests to Vibesites — both MCP tool calls from Claude and direct REST API requests. Every account gets one API key on signup.
Finding your API key
Your API key is in Account Settings. It's masked by default — click to reveal and copy.
Key format
All Vibesites API keys start with the prefix vibe_live_ followed by a random hex string. Example: vibe_live_a3f8c1e9b2d4.
How keys are used
- MCP connections: Embedded in the connector URL as a query parameter:
vibesites.dev/api/mcp?key=vibe_live_xxx - REST API: Passed as a Bearer token in the Authorization header:
Authorization: Bearer vibe_live_xxx
Rotating your key
If your key is compromised, rotate it immediately from Account Settings. Rotation is instant:
- The old key stops working immediately
- A new key is generated and displayed
- You'll need to update your MCP connector URL with the new key
Security
Never commit your API key to version control. Add
.mcp.json to your .gitignore. Your key grants full access to create, edit, and delete all your sites.Rate limits
API rate limits depend on your plan:
| Plan | Edits/day | Sites |
|---|---|---|
| Free | 100 | 3 |
| Starter ($9/mo) | 1,000 | 10 |
| Pro ($29/mo) | Unlimited | Unlimited |