Skip to main content
Direct Developer API requests use an Autype API key. Interactive remote MCP clients such as ChatGPT and Claude authenticate against the MCP server with OAuth; Autype then performs a server-side token exchange before the MCP server calls the Developer API.

​
Providing your API key

Include your API key in the X-API-Key header (case-insensitive):
Never place an API key in browser code or a committed MCP configuration file. OAuth-capable clients should connect to https://mcp.autype.com/mcp and complete browser consent instead. The trailing-slash form is accepted and normalized to the same protected resource.

​
OAuth through the MCP server

Remote MCP clients discover Autype’s OAuth 2.1 endpoints automatically. After browser consent they receive a short-lived token bound to the MCP resource. The trusted Autype MCP service exchanges it for a separate, short-lived Developer API audience token before making internal API calls.
The first token is bound to the approved user, organization, client, scopes, and MCP resource. The second is bound to the same identity and equal or narrower scopes, but to the Developer API audience. Raw MCP resource tokens, Autype login JWTs, and third-party Bearer tokens are rejected by the Developer API. End users never need to perform this exchange manually. See the MCP integration overview for the complete connection flow. Users can review and revoke their own grants under Settings → Connected Apps. A disconnect is scoped to the selected OAuth client and organization and immediately revokes both foreground and background access. It does not delete the globally registered OAuth client or affect grants made by other users.

​
API key scopes

  • API keys are bound to your organization
  • All operations and resources are scoped to your organization
  • Credit costs are deducted from your organization’s balance
  • Every protected endpoint declares the scopes it requires
Choose only the permissions the integration needs: When scopes are omitted while creating a key, Autype grants all currently available scopes for backward compatibility. An explicitly empty scope list is rejected. Requests to endpoints outside the granted scopes return 403.

​
Security best practices

API keys should only be used in server-side applications. Never include them in JavaScript that runs in the browser.
Store your API key in environment variables rather than hardcoding it in your source code.
Create new API keys periodically and revoke old ones. You can manage keys in your dashboard.
Create separate API keys for development, staging, and production environments.

​
Error responses