Authentication

Every connector, MCP, memory, and account-management request is resolved inside a user and organization boundary. Two pasted credential types are accepted across three header forms, plus a browser OAuth flow for interactive MCP clients:

Authenticate connector discovery

curl https://api.corespeed.io/connectors \
  -H "Authorization: Bearer $CORESPEED_API_KEY"

curl https://api.corespeed.io/connectors \
  -H "x-api-key: $CORESPEED_API_KEY"

The response is caller-specific: it includes visible connectors, connection status, account aliases, and whether this caller can remove an account.

Authenticate MCP

The same credentials work on the unified /mcp endpoint:

curl https://api.corespeed.io/mcp \
  -H "Authorization: Bearer $CORESPEED_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "initialize",
    "params": {
      "protocolVersion": "2024-11-05",
      "capabilities": {},
      "clientInfo": {"name": "my-agent", "version": "1.0.0"}
    }
  }'

Create, rotate, cap, and revoke agent keys in Dashboard → Keys.

MCP OAuth (browser sign-in)

Interactive MCP clients can authorize /mcp with no pasted key. An unauthenticated call returns a 401 whose WWW-Authenticate header advertises the RFC 9728 protected-resource metadata; the client discovers CoreSpeed's authorization server (WorkOS AuthKit), runs OAuth 2.1 + PKCE in the browser, and retries /mcp with the issued token. The token is bound to the /mcp resource (RFC 8707). See MCP endpoint for the client config and the full flow.

Browser sign-in is rolling out per environment; the API key and WorkOS JWT above work everywhere today.

Requests without a bearer credential

GET /health is the only product endpoint in this documentation that needs no caller credential. Artifact downloads use a short-lived signed URL instead of the headers above; do not strip or reuse its signature.

Error responses

HTTP errors use a nested error object:

{
  "error": {
    "type": "authentication_error",
    "message": "Authorization header or x-api-key is required",
    "code": "missing_authorization"
  }
}

MCP tool failures can arrive inside an HTTP 200 response with isError: true. Always inspect the JSON-RPC result in addition to the HTTP status.