Authentication

Your API key tells Virlo who is calling and which balance to charge.

Get an API key

Add funds, then click Generate Key on the API keys page. Copy the key now: it's shown only once.

• Keys start with virlo_tkn_. Each team shares up to 10 active keys.
• In the dashboard, only team owners and admins can generate or revoke keys.

Who can see what

• The whole team: the balance, lookups, tracked creators and videos, and webhooks.
• One person: Content Research Agents are private to the person whose key created them. Teammates' keys get 404 (not found).

Send your key

Run this free check in a terminal, replacing YOUR_API_KEY with your whole key:

curl https://api.virlo.ai/v1/account/balance \
  -H "Authorization: Bearer YOUR_API_KEY"

{
  "data": {
    "balance": "$25.00",
    "credits_remaining": 2500,
    "status": "active"
  }
}

When a key is rejected

The 401 message tells you why:

• API key is required (missing_api_key): no key in the Authorization header. x-api-key and ?api_key= aren't accepted.
• Invalid API key format (invalid_api_key): the key doesn't look like virlo_tkn_.... Usually bearer instead of Bearer, an extra space, or an empty key.
• Invalid or inactive API key (invalid_api_key): the key is mistyped, revoked, or has virlo_tkn_ pasted twice.

Rapid retries from one computer with a missing or malformed key get briefly blocked (429, too_many_requests). Fix the key first.

Keep your key safe

• Anyone with your key can spend your balance. Keep it out of chats, shared docs, web page code, and Git.
• If a key leaks, revoke it on the API keys page and generate a new one. Revoking cuts off everyone on your team using that key.

Using the MCP server

AI assistants like Claude can use Virlo, paid from your team's balance.

• Claude Desktop, claude.ai, Claude Code: anyone who signs in gets a new team key (needs funds and under 10 active keys).
• Cursor, VS Code, Windsurf, Codex: paste an API key.