Features

REST API and MCP server

Each key belongs to one workspace and reads only its data. The API and the MCP server work only for an organisation whose plan includes them; the plan is checked on every request.

Last reviewed 27 September 2026

Plans and limits

The API and the MCP server are included from the Growth plan. Limits apply per key; the daily quota resets at 00:00 UTC. Prices are on the Pricing page.

Plan	Active keys	Requests / day	Requests / minute
Free	Not included	—	—
SEO	Not included	—	—
SEO + AI	Not included	—	—
Growth	2	1,000	60
Pro	5	5,000	120
Agency	20	25,000	300
Enterprise	50	100,000	600

Changing plan: a plan that no longer includes the API (moving to SEO or Free, cancelling, a period ending) stops every key within a minute, with 402 PLAN_REQUIRED. Keys are not deleted: they work again if the plan includes the API again.
Moving to a plan with fewer keys does not cut existing keys, but no new key can be created while the active keys exceed the plan.
AI visibility follows the dashboard's rule: it is served only when the plan includes AI share of voice.

Create and revoke a key

Open Sources & reports › Integrations, reports, MCP & API › MCP and API connector in your workspace.
Name the key (the tool that will use it) and, if you wish, an expiry (30, 90, 180 days or 1 year).
Copy the key shown: it is displayed only once. NeoRank keeps only a fingerprint of it (HMAC-SHA-256) and cannot show it again.

Only organisation administrators (owner, admin) and workspace administrators can create or revoke a key; other members see the list (name, prefix, author, last use, status) read-only.
A revoked key stops working immediately. A key also stops working when its author leaves the workspace.
Every creation and revocation is written to the audit log.

Authentication

Every request sends the key in the Authorization: Bearer nrk_live_… header. Session cookies are never read on the API: a key is the only way in. No third-party origin is allowed by CORS; call the API from a server or a tool, not from a browser.

curl -H "Authorization: Bearer nrk_live_…" https://neorank.ai/api/v1/sites

Endpoints (read-only)

Request	Response
`GET /api/v1/sites`	The sites of the key's workspace (id, name, domain).
`GET /api/v1/sites/{siteId}/overview?days=28`	Search Console totals for the period (7, 28, 90, 180 or 365 days), AI visibility, NeoRank authority score and the latest audit summary.
`GET /api/v1/sites/{siteId}/ai-visibility`	Brand share of voice, mentions and answers per AI engine over the latest observation runs.
`GET /api/v1/sites/{siteId}/rankings?page=1&pageSize=100`	Tracked keywords: latest and previous position, source (rank check or Search Console average), volume, difficulty.
`GET /api/v1/sites/{siteId}/audit-issues?page=1&pageSize=50&severity=ERROR`	The findings of the latest completed crawl, paginated (at most 100 per page).
`GET /api/v1/sites/{siteId}/backlinks`	NeoRank authority score, historical totals and the most recent observed links (a stated sample).

Response format

Every answer is a data object with meta (workspace, generation time, where the figures come from, pagination). An error is an error object with a stable code and a message. `null` means “not measured”, never zero; a state field says why a block is empty (not-connected, not-measured, plan-required…).

{
  "data": [{ "id": "…", "name": "Example", "domain": "example.com", "createdAt": "…" }],
  "meta": { "workspaceId": "…", "generatedAt": "…", "source": "NeoRank workspace", "returned": 1 }
}

{ "error": { "code": "PLAN_REQUIRED", "message": "…" } }

Rate limits

X-RateLimit-Limit / Remaining / Reset: The key's one-minute window (Reset in seconds).
X-RateLimit-Daily-Limit / Daily-Remaining / Daily-Reset: The key's quota for the UTC day (Reset in seconds until UTC midnight).
Retry-After: On a 429 answer: how many seconds to wait.

Errors

Status	Codes
401	`AUTH_REQUIRED`, `INVALID_API_KEY`, `API_KEY_REVOKED`, `API_KEY_EXPIRED`, `API_KEY_INACTIVE`
402	`PLAN_REQUIRED` — the organisation's plan does not include the API (or the dimension asked for)
400	`INVALID_PARAMETER`
404	`SITE_NOT_FOUND` — also for a site of another workspace
429	`RATE_LIMITED` (per minute) or `DAILY_QUOTA_EXCEEDED`, with `Retry-After`
503	`ENTITLEMENT_CHECK_UNAVAILABLE`, `RATE_LIMIT_UNAVAILABLE`, `API_UNAVAILABLE` — retry later

MCP server

The remote MCP server answers at https://neorank.ai/api/mcp (Streamable HTTP, stateless, JSON answers) with the same key, the same limits and the same plan check. Read-only tools: list_sites, get_site_overview, get_ai_visibility, get_rankings, get_audit_issues, get_backlinks_summary. Your instance's exact address and ready-to-copy configurations are in the MCP and API connector tab.

Claude Code (terminal):

claude mcp add --transport http neorank https://neorank.ai/api/mcp --header "Authorization: Bearer nrk_live_…"

Cursor and MCP clients that accept a remote address and headers (the client's MCP servers JSON configuration):

{
  "mcpServers": {
    "neorank": {
      "url": "https://neorank.ai/api/mcp",
      "headers": { "Authorization": "Bearer nrk_live_…" }
    }
  }
}

Claude Desktop: through the mcp-remote bridge (Node.js required), which relays requests to the remote server with the header:

{
  "mcpServers": {
    "neorank": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://neorank.ai/api/mcp", "--header", "Authorization:${NEORANK_AUTH}"],
      "env": { "NEORANK_AUTH": "Bearer nrk_live_…" }
    }
  }
}

Security

Keys: indexed public prefix, 256-bit secret, HMAC-SHA-256 fingerprint with a server secret, constant-time comparison.
Isolation: every request is limited to the key's workspace; a site id from another workspace answers 404.
Log: method, route, status, key and duration of each request; never the body or the key.
MCP server: body capped at 64 KiB, third-party browser origins refused, no outbound network call.

Plans and limits

Create and revoke a key

Authentication

Endpoints (read-only)

Response format

Rate limits

Errors

MCP server

Security

Need more help?