Authentication
The API has no accounts or keys yet. The owner's dashboard sign-in doesn't apply here.
Public endpoints need nothing: plans, pricing, states, services, classes, marks, sites, filing types, docs and quotes. They're limited per IP address.
Formations, orders, applications and filings each have their own token. Send it as a bearer token:
curl https://api.joinopenfile.com/v1/applications/$ID \
-H "Authorization: Bearer $TOKEN"Over MCP, pass it as the tool's token input.
| Token | Where it comes from | What it opens |
|---|---|---|
| Formation | token on the create response | That formation |
| Order | order.token once signed, or k in the owner's order link | That order |
| Application | token on the create response | That application |
| Filing | filing.token once signed, or k in the customer's status link | That filing |
A wrong token gets the same 404 as a wrong id.
Tokens can't be reset, so treat them like passwords. review_url and status_url contain them, so send those only to the owner.