> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sapt.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, OAuth, and connector sign-in.

Every endpoint in this reference requires an `Authorization` header. The API
picks an identity resolver from the header's prefix.

| You are                                   | Use                                    |
| ----------------------------------------- | -------------------------------------- |
| A backend, script, or cron job you own    | **API key**                            |
| Claude, ChatGPT, or another MCP client    | **Connector OAuth** — nothing to paste |
| An app acting across Projects for a user  | **OAuth2 client**                      |
| First-party browser code on a Sapt origin | **Session cookie**                     |

## API keys

The right choice for server-to-server work.

### Create one

<Steps>
  <Step title="Open the dashboard">
    Go to the [Sapt dashboard](https://app.sapt.ai). No account yet?
    [Sign up](https://app.sapt.ai/sign-up).
  </Step>

  <Step title="Open your account">
    Click your **profile** in the bottom left → **Account**.
  </Step>

  <Step title="Create the key">
    Click **Create API Key** and copy it. Keys start with `sapt_`.
  </Step>
</Steps>

<Warning>
  An API key is shown only once. Put it in an environment variable — never commit
  one to source control.
</Warning>

### Use it

```bash theme={null}
curl https://api.sapt.ai/socials/accounts/$PROJECT_ID \
  -H "Authorization: ApiKey sapt_your_api_key"
```

<Note>
  The prefix is `ApiKey`, not `Bearer`. A key sent as `Bearer` falls through to
  the OAuth token resolver and fails with `401`.
</Note>

Keys are Project-scoped: every operation is restricted to resources inside the
Projects the key was issued for. Calling a `projectId` outside that scope
returns `403`.

## Connector OAuth

Claude and ChatGPT use OAuth when you add Sapt as a connector. Point them at:

```
https://mcp.sapt.ai/mcp
```

Sign in with your Sapt account when the client prompts you. Sapt uses your
account permissions to decide which Projects and tools the connector can reach —
you never paste an API key into Claude or ChatGPT for normal connector setup.

See [Connect Claude or ChatGPT](/docs/mintlify/mcp/connect) for the click-through.

## OAuth2 clients

When you need to act across multiple Projects on a user's behalf — an
integration that lets agencies onboard their own clients, say — register an
OAuth2 client and use the standard authorization-code grant.

|                       |                                                    |
| --------------------- | -------------------------------------------------- |
| **Authorize URL**     | `https://api.sapt.ai/api/auth/oauth2/authorize`    |
| **Token URL**         | `https://api.sapt.ai/api/auth/oauth2/token`        |
| **Recommended scope** | `openid profile email offline_access account:full` |

Send the resulting access token as a bearer token:

```bash theme={null}
curl https://api.sapt.ai/auth/me \
  -H "Authorization: Bearer $ACCESS_TOKEN"
```

`/auth/me` returns the authenticated user's identity — the usual first call to
discover which Projects a token can reach.

## Session cookies

Browser clients on a Sapt origin are authenticated by session cookie
automatically. No header is needed. This path is for first-party dashboard code,
not for integrations.

## WebSocket connections

For long-lived streams and custom clients, credentials are exchanged for
short-lived JWTs at the connection layer. Supported connector clients handle
this transparently.

## Permissions

Authentication resolves *who* you are; authorization is checked per endpoint
against the Project's role and permission model. A valid credential with
insufficient permission on that Project returns `403 FORBIDDEN` — reading social
accounts, for example, needs `social:read`.