# Authentication

One kind of token works for both the MCP server and the REST API. Sign in with OAuth where your client supports it, or create an API key.

Canonical: https://chikaraintel.com/docs/authentication

## Two ways to get a token

| Method | Use it for | Where |
| --- | --- | --- |
| OAuth sign-in | Claude, Claude Code and other MCP clients that can open a browser | Your client starts it. You sign in to Chikara Intelligence and approve access |
| API key | Scripts, the REST API, and MCP clients without OAuth | **MCP Access** in the app, under **Advanced**, then **Create API key** |

## OAuth for MCP clients

Point the client at `https://mcp.chikaraintel.com/mcp` with no key. On the first call the server answers 401 with a pointer to its OAuth metadata, and the client opens a browser window for you to sign in and approve. The client registers itself, so leave any client ID and secret fields empty.

Each approved client appears under **Connected apps** on the [MCP Access page](https://app.chikaraintel.com/account/mcp), named after the client.

## Creating an API key

1. Open the [MCP Access page](https://app.chikaraintel.com/account/mcp) from the account menu in the app.
2. Under **Advanced**, choose **Create API key**.
3. Name it after where it'll be used, such as `Reporting script`.
4. Copy the key. It's shown once and can't be retrieved later.

## Sending the token

Send it as a bearer token on every request, to the API and the MCP server alike.

**cURL**

```bash
export CHIKARA_API_TOKEN="<your-token>"

curl -sS "https://api.chikaraintel.com/v1/profiles?search=Marchetti&limit=1" \
  -H "Authorization: Bearer $CHIKARA_API_TOKEN"
```

**Header**

```text
Authorization: Bearer <your-token>
```

> **Treat a key like a password** A key carries your account's access. Keep it in an environment variable or a secrets manager, never in source control, and don't share it outside your organisation.

## Expiry and revoking

API keys and OAuth tokens don't expire. They work until revoked. Revoke either from the MCP Access page: **Revoke** on a key, **Disconnect** on a connected app. The MCP server may keep accepting a revoked token for up to 30 seconds while its cache clears.

## What a token can reach

Every call runs as you. The token reaches exactly what your plan covers, whether the call comes from a script, the MCP server or an assistant, and each call is recorded against your account.

## When authentication fails

A missing, malformed, expired or revoked token returns 401 with `Unauthorized`. See [errors](/docs/api/errors).

## Related

- https://chikaraintel.com/docs/mcp.md
- https://chikaraintel.com/docs/api.md
- https://chikaraintel.com/docs/limits.md