API keys
API keys are the standard authentication method for the Python and TypeScript SDKs and other headless integrations. Create a scoped key in the Gumnut web app, store it as a secret, and send it as a Bearer token. Create and use an API key →OAuth for user-facing integrations
Gumnut’s OAuth implementation supports user-facing integrations that need delegated access through Clerk. MCP hosts are one supported client: they use OAuth discovery, complete the user’s consent flow, manage the resulting token, and send it when calling Gumnut’s MCP server. For SDKs and scripts, use an API key instead of an interactive OAuth flow. Understand the MCP OAuth flow →Security
- Send credentials only over HTTPS.
- Keep API keys out of source control and browser bundles.
- Scope API keys to the least access required and revoke credentials that are no longer needed.
- Authentication does not bypass rate limits.