Authentication

In brief

Two modes: Bearer API key (ak_live_ for server/MCP, pk_live_ for client) or OAuth 2.0 (Claude connectors). Never use the legacy sk_* prefix.

Secret API key (REST & MCP)

Prefix ak_live_. Pass it as Authorization: Bearer on https://api.askmarcel.app/v1/* and https://mcp.askmarcel.app.

Header

Authorization: Bearer ak_live_...

Publishable key (client-side)

Prefix pk_live_. For front-end apps only, via X-AM-Key header. Restricted scopes — never in public repos.

Header

X-AM-Key: pk_live_...

OAuth 2.0 (Claude Desktop / connectors)

Full discovery on mcp.askmarcel.app: /.well-known/oauth-protected-resource, /.well-known/oauth-authorization-server. Authorization Code flow with dynamic client registration.

Authorize: app.askmarcel.app/api/oauth/authorize
Token: app.askmarcel.app/api/oauth/token
Register: app.askmarcel.app/api/oauth/register
Revoke: app.askmarcel.app/api/oauth/revoke

Create a key

Keys are created only in the authenticated developer area: https://app.askmarcel.app/developers. Public docs never display real keys.

Never commit keys

Use environment variables. Revoke any exposed key immediately from /developers.