AnswerixAI uses three authentication schemes depending on the endpoint family.
1. API keys (ans_ tokens) — programmatic access
The stable, integration-friendly surface is the /api/mcp/* family (and the MCP server itself). It authenticates with an API key created under Settings → API Keys:
curl https://your-answerix-host/api/mcp/whoami \
-H "Authorization: Bearer ans_..."
Keys are organization-scoped: every request sees exactly the brands the key's owner can access. The token is shown once at creation; only a hash is stored server-side. Revoke a key from the same settings page — access is cut immediately.
2. Session auth — dashboard endpoints
The dashboard's own endpoints (/dashboard/* and /api/tracking/*, /api/content/*, /api/prompts/*, …) use Laravel session authentication with CSRF protection — the same cookie your browser gets when you sign in. These power the web UI; for scripts and integrations prefer the ans_ key surface above.
If you do call them from custom frontend code running on the app's own origin, include the X-XSRF-TOKEN header (Laravel sets the XSRF-TOKEN cookie automatically).
3. Cron secret — internal endpoints
Two internal endpoints (used to trigger tracking out-of-band) authenticate via a shared CRON_SECRET:
curl -X POST https://your-answerix-host/api/internal/daily-tracking \
-H "Authorization: Bearer $CRON_SECRET"
Set CRON_SECRET in .env. On self-hosted installs you normally don't need these — the built-in scheduler (php artisan schedule:work) runs daily tracking itself.
Public endpoints
A few endpoints require no auth by design:
GET /t.js— tracking pixel scriptPOST /track/{code}— tracking pixel beacon (validates the brand tracking code)POST /cloro/callback— Cloro scraper webhook (verified by HMAC signature, not auth)GET /ai/{token}/{file}— hosted AI-readability files (llms.txtetc., token-scoped)GET /api/health— basic uptime check
Continue: Brands & data →