Authentication
API keys for the REST API, OAuth 2.1 for MCP and the Claude Code plugin.
REST API: API keys
Mint a per-workspace key in Settings → Workspace → API (/settings/workspace/api). Keys look like ok_live_…, shown once at creation — store in a secret manager.
Pass as a Bearer token on every request:
Authorization: Bearer ok_live_…Keys are workspace-scoped (a key from workspace A cannot access workspace B), stored only as a SHA-256 hash. If lost, mint a new one and revoke the old.
MCP and Claude Code plugin: OAuth 2.1
The hosted MCP server (https://api.orbitpeople.ai/mcp) and the Claude Code plugin use OAuth 2.1 with PKCE. On first use:
- The client redirects to Orbit's authorization endpoint.
- You approve the consent screen.
- The client stores an access token automatically.
Tokens expire in 1 hour and refresh silently. To cut a client off, disconnect it from its own MCP settings; to cut every client off at once, ask Orbit support.
Summary
| Surface | Auth | Where to get credentials |
|---|---|---|
| REST API | API key (ok_live_…) | Settings → Workspace → API |
MCP server (/mcp) | OAuth 2.1 | Browser consent (auto) |
| Claude Code plugin | OAuth 2.1 | Browser consent (auto) |