API keys are now required

Effective with the September 20, 2026 account-enforcement release, identification and pricing require a free Strata account and API key. This replaces the earlier anonymous beta and its proposed notice period. Requests without keys now return 401 api_key_required; they do not consume lookup credits.

Get your agent working again

1. Open https://stratatcg.com/connector/dashboard#signup. Sign in with Google, Apple or email. Existing Strata users should choose their usual sign-in method. Email signup requires confirmation.
2. Under API keys, name your agent and select Create key. Copy the key while it is displayed.
3. Save it in your agent's secure Strata connector/API-key setting. The agent sends Authorization: Bearer <key> on each lookup. Do not paste passwords, browser sessions or keys into shared chat.
4. Retry the original request. Request bodies and existing Vercel API URLs still work; new integrations should use https://stratatcg.com/connector.

If your agent has no secure key setting, ask it to guide you through configuring a local secret environment variable. Do not send it your account password.

For agents

On api_key_required, stop retrying and give the user the setupUrl and steps in the response. These instructions and GET discovery endpoints remain public. Invalid supplied keys never fall back to anonymous access.

• api_key_malformed: copy the complete strata_… key again.
• api_key_revoked, api_key_expired, api_key_invalid: create a replacement in the dashboard. Older expired/revoked keys may return api_key_invalid after the diagnostic retention period.
• account_quota_exceeded (429): read the active policy and account reset date; wait for reset or let the owner review an eligible plan change. Do not create extra accounts to bypass limits.
• daily_limit (429): the shared pool is full; wait for the indicated reset.

The public /api/billing/status endpoint reports the active plan policy. The dashboard reports your account balance and reset date. Under monthly billing, each successful confident identity or usable selected-market price costs one credit; a combined request can cost two. Unused reservations are returned. Purchases require an explicit checkout by the account owner.

Keys expire after 90 days. Create and test a replacement before revoking the old key. Responses include X-Strata-Key-Expires-At, plus X-Strata-Key-Warning during the last 14 days. Key revocation is immediate; deleted-account access can persist for at most 60 seconds due to the account cache. Resetting a password signs out browser sessions but keeps API keys active; revoke untrusted keys in the dashboard.

X-Strata-Auth: required and X-Strata-Migration describe the live policy.