Access / API

Authentication

Applications use a key in the X-API-Key header. Hosted MCP clients sign in through the browser and never ask you to paste that key.

API key (X-API-Key)

Sites, apps and your own services send X-API-Key in the request header. Keep the value in a server environment variable, never in the frontend.

Example request

# Get today's calendar

curl -G "https://api.caminhoanglicano.com.br/api/v1/calendar/today" \

-H "X-API-Key: estevao_sua_chave_secreta" \

--data-urlencode 'preferences={"prayer_book_code":"loc_2015"}'

Important: the calendar and explanation endpoints require preferences carrying at least prayer_book_code. Each book's preference catalogue shows the other accepted values.

Limits by plan Every key is limited by the account's plan. A 429 carries a Retry-After header with the wait; the current plan and its limits are on the billing page.

Protect your key

Never expose an API key where the end user can inspect it, such as JavaScript running in the browser. Always put a backend of your own in between.