Authentication
API keys for REST/SDK, OAuth 2.1 for MCP and the Claude Code plugin.
REST API and SDK: API keys
Mint a per-workspace key in Settings → API keys. Keys look like ok_live_…, shown once at creation — store in a secret manager.
Pass as a Bearer token on every request:
Authorization: Bearer ok_live_…Keys are workspace-scoped (a key from workspace A cannot access workspace B), stored only as a SHA-256 hash. If lost, mint a new one and revoke the old.
MCP and Claude Code plugin: OAuth 2.1
The hosted /mcp endpoint and the Claude Code plugin use OAuth 2.1 with PKCE. On first use:
- The client redirects to Orbit's authorization endpoint.
- You approve the consent screen.
- The client stores an access token automatically.
Tokens expire in 1 hour with silent refresh. Revocable from Settings → Connected apps.
Summary
| Surface | Auth | Where to get credentials |
|---|---|---|
| REST API | API key (ok_live_…) | Settings → API keys |
@orbit/sdk | API key | Settings → API keys |
orbit-mcp (stdio) | API key | Settings → API keys |
/mcp remote | OAuth 2.1 | Browser consent (auto) |
| Claude Code plugin | OAuth 2.1 | Browser consent (auto) |