> ## Documentation Index
> Fetch the complete documentation index at: https://docs.taketime.space/llms.txt
> Use this file to discover all available pages before exploring further.

# Take Time API Authentication — Keys, Types & Rate Limits

> Authenticate Take Time API requests using Bearer token API keys. Learn about key types, how to generate keys, rate limits, and MCP Server configuration.

All Take Time API requests are authenticated with an API key passed as a Bearer token in the `Authorization` header. Generate your key in the app under **Settings → Developer**, then include it with every request.

## API keys

Pass your key in the `Authorization` header on every request:

```http theme={null}
Authorization: Bearer tt_live_your_key_here
```

### Key types

| Prefix     | Environment | Description                          |
| ---------- | ----------- | ------------------------------------ |
| `tt_live_` | Production  | Full access to your real data        |
| `tt_test_` | Sandbox     | Test mode — no real data is affected |

### Generate a key

<Steps>
  <Step title="Open Settings">
    In the Take Time app, navigate to the **Settings** tab (gear icon).
  </Step>

  <Step title="Go to the Developer section">
    Scroll to **Developer** and tap **Generate API Key**.
  </Step>

  <Step title="Copy and save your key">
    Copy the key immediately — it is only shown once. Store it in a secure location such as a password manager or secrets vault.
  </Step>
</Steps>

<Warning>
  Never expose your API key in client-side code, public repositories, or browser requests. Always use it server-side or in a secure environment such as an MCP server config or environment variable.
</Warning>

## Rate limits

| Plan | Requests / min | Requests / day |
| ---- | -------------- | -------------- |
| Free | 30             | 1,000          |
| Pro  | 120            | 10,000         |

When you exceed a rate limit, the API returns `429 Too Many Requests` with a `Retry-After` header indicating how many seconds to wait before retrying.

## Permissions

Each API key has full access to the owning account's data. There are no granular permission scopes at this time.

<Info>
  Scoped permissions — such as read-only keys or per-resource access — are planned for a future release.
</Info>

## Using with the MCP Server

When configuring the Take Time MCP Server, pass your API key as an environment variable. The server reads `TAKETIME_API_KEY` and authenticates all requests automatically — you never need to handle the header yourself.

```json theme={null}
{
  "mcpServers": {
    "taketime": {
      "command": "npx",
      "args": ["@taketime/mcp-server"],
      "env": {
        "TAKETIME_API_KEY": "tt_live_your_key_here"
      }
    }
  }
}
```

<Tip>
  Use a `tt_test_` key while setting up your MCP integration so no real data is modified during testing.
</Tip>