Guide

Authentication

One kind of token works for both the MCP server and the REST API. Sign in with OAuth where your client supports it, or create an API key.

Two ways to get a token

MethodUse it forWhere
OAuth sign-inClaude, Claude Code and other MCP clients that can open a browserYour client starts it. You sign in to Chikara Intelligence and approve access
API keyScripts, the REST API, and MCP clients without OAuthMCP Access in the app, under Advanced, then Create API key

OAuth for MCP clients

Point the client at https://mcp.chikaraintel.com/mcp with no key. On the first call the server answers 401 with a pointer to its OAuth metadata, and the client opens a browser window for you to sign in and approve. The client registers itself, so leave any client ID and secret fields empty.

Each approved client appears under Connected apps on the MCP Access page, named after the client.

Creating an API key

  1. Open the MCP Access page from the account menu in the app.
  2. Under Advanced, choose Create API key.
  3. Name it after where it'll be used, such as Reporting script.
  4. Copy the key. It's shown once and can't be retrieved later.

Sending the token

Send it as a bearer token on every request, to the API and the MCP server alike.

export CHIKARA_API_TOKEN="<your-token>"

curl -sS "https://api.chikaraintel.com/v1/profiles?search=Marchetti&limit=1" \
  -H "Authorization: Bearer $CHIKARA_API_TOKEN"

Expiry and revoking

API keys and OAuth tokens don't expire. They work until revoked. Revoke either from the MCP Access page: Revoke on a key, Disconnect on a connected app. The MCP server may keep accepting a revoked token for up to 30 seconds while its cache clears.

What a token can reach

Every call runs as you. The token reaches exactly what your plan covers, whether the call comes from a script, the MCP server or an assistant, and each call is recorded against your account.

When authentication fails

A missing, malformed, expired or revoked token returns 401 with Unauthorized. See errors.

Related