# API keys are now required

Effective with the September 20, 2026 account-enforcement release, identification and pricing require a free Strata account and API key. This replaces the earlier anonymous beta and its proposed notice period. Requests without keys now return `401 api_key_required`; they do not consume lookup credits.

## Get your agent working again

1. Open https://stratatcg.com/connector/dashboard#signup. Sign in with Google, Apple or email. Existing Strata users should choose their usual sign-in method. Email signup requires confirmation.
2. Under **API keys**, name your agent and select **Create key**. Copy the key while it is displayed.
3. Save it in your agent's secure Strata connector/API-key setting. The agent sends `Authorization: Bearer <key>` on each lookup. Do not paste passwords, browser sessions or keys into shared chat.
4. Retry the original request. Request bodies and existing Vercel API URLs still work; new integrations should use https://stratatcg.com/connector.

If your agent has no secure key setting, ask it to guide you through configuring a local secret environment variable. Do not send it your account password.

## For agents

On `api_key_required`, stop retrying and give the user the `setupUrl` and `steps` in the response. These instructions and GET discovery endpoints remain public. Invalid supplied keys never fall back to anonymous access.

- `api_key_malformed`: copy the complete `strata_…` key again.
- `api_key_revoked`, `api_key_expired`, `api_key_invalid`: create a replacement in the dashboard. Older expired/revoked keys may return `api_key_invalid` after the diagnostic retention period.
- `account_quota_exceeded` (429): read the active policy and account reset date; wait for reset or let the owner review an eligible plan change. Do not create extra accounts to bypass limits.
- `daily_limit` (429): the shared pool is full; wait for the indicated reset.

The public /api/billing/status endpoint reports the active plan policy. The dashboard reports your account balance and reset date. Under monthly billing, each successful confident identity or usable selected-market price costs one credit; a combined request can cost two. Unused reservations are returned. Purchases require an explicit checkout by the account owner.

Keys expire after 90 days. Create and test a replacement before revoking the old key. Responses include `X-Strata-Key-Expires-At`, plus `X-Strata-Key-Warning` during the last 14 days. Key revocation is immediate; deleted-account access can persist for at most 60 seconds due to the account cache. Resetting a password signs out browser sessions but keeps API keys active; revoke untrusted keys in the dashboard.

`X-Strata-Auth: required` and `X-Strata-Migration` describe the live policy.