Authentication

How to authenticate with the AEO Goal REST API using Bearer tokens.

Last updated August 31, 2026

The AEO Goal REST API uses Bearer token authentication. All API requests must include an Authorization header with a valid API key.

Getting a token

Create a personal API key in Settings → API (see API Keys & Scopes).

Your key starts with aeo_ and looks like:

aeo_AbCdEfGhIjKlMnOpQrStUvWxYz01234567890123456789

The full secret is shown only once at creation time - copy and store it securely. AEO Goal never shows the full key again; only the first 8 characters are stored and displayed.

Making authenticated requests

Include the key in every request as a Bearer token:

curl https://api.aeogoal.com/api/ai-search \
  -H "Authorization: Bearer aeo_YOUR_KEY_HERE"

Base URL

All API endpoints are at:

https://api.aeogoal.com

What API keys can access

Personal API keys access the product API (citations, prompts, keywords, content, reports, etc.). They are blocked from sensitive endpoints regardless of scope:

  • Billing and account management (/api/billing, /api/me/organization)
  • Team and user management (/api/teams, /api/admin)
  • Security and auth (/api/auth, /api/sessions, /api/oauth)
  • Onboarding (/api/onboarding)
  • Course checkout (/api/courses)
  • Key management itself (/api/me/api-keys)

These endpoints require an interactive browser session - no scope grants API key access to them.

Error responses

Status Meaning
401 Unauthorized Missing or invalid Bearer token
403 Forbidden Valid token but blocked endpoint (sensitive path) or insufficient scope
429 Too Many Requests Rate limit exceeded; retry after Retry-After header

MCP vs. REST API

The MCP server uses a separate OAuth flow (not personal API keys). If you’re connecting Claude or Cursor, see MCP Connectors instead.

Frequently asked questions

How does the AEO Goal API authenticate?

With Bearer token authentication. Every request must include an Authorization header of the form 'Bearer aeo_YOUR_KEY', using a key that starts with aeo_.

Where do I find my API key?

Create a personal API key in Settings then API. The full secret is shown only once at creation time, so copy and store it securely - AEO Goal never shows the full key again.

What can an API key not access?

Sensitive endpoints are always blocked regardless of scope: billing and account, team and user management, auth and sessions, onboarding, course checkout, and key management. Those require an interactive browser session.

How is the MCP server different from the REST API?

The MCP server uses a separate OAuth flow, not personal API keys. If you are connecting Claude or Cursor, use the MCP connector instead of a Bearer token.