# Outlit Auth

Outlit has three agent-facing access surfaces: REST API, CLI, and remote MCP. This file does not claim universal self-serve agent OAuth for every Outlit surface. REST API automation currently uses workspace API keys; remote MCP OAuth depends on the workspace URL and client support.

## Pick a method

- Use the REST API when you need HTTP access to platform, tool, integration, or ingest endpoints.
- Use the CLI when you are working inside a terminal or coding-agent environment.
- Use remote MCP when your agent client supports Streamable HTTP MCP and OAuth.

The canonical API reference is published in the docs at https://docs.outlit.ai/api-reference/introduction.
The canonical OpenAPI spec is https://docs.outlit.ai/openapi.json. Marketing does not publish a separate OpenAPI copy, so crawlers and agents do not index a second marketing-owned source of truth.

## Register

API access uses Outlit workspace API keys. For REST API access, create or rotate a workspace API key in the Outlit app at https://app.outlit.ai/settings/workspace/api-keys.

For CLI access, run:

```sh
outlit auth login
```

If the CLI asks for a key, create one in Settings > API Keys. The install script is available at https://outlit.ai/install.sh.

Remote MCP clients use workspace MCP URLs with OAuth where supported by the client. For MCP access, copy the workspace-specific MCP URL from https://app.outlit.ai/settings/workspace/mcp. Remote MCP clients should use the workspace URL when available.

## Claim

REST API keys authorize requests for one Outlit workspace. Store the key as a secret, not in source control, and scope usage to the automation or environment that needs it.

MCP OAuth claims are established by the MCP client during the OAuth flow for the workspace MCP resource. Canonical MCP OAuth metadata is served by the MCP service:

- Protected resource: https://mcp.outlit.ai/.well-known/oauth-protected-resource/mcp
- Workspace protected resource: https://mcp.outlit.ai/w/<workspace-slug>/.well-known/oauth-protected-resource/mcp
- Authorization server: https://clerk.outlit.ai/.well-known/oauth-authorization-server

## Use credential

Send REST API keys as Bearer tokens:

```http
Authorization: Bearer OUTLIT_API_KEY
```

Use the MCP client OAuth flow for remote MCP. Do not hardcode shared bearer tokens into MCP client configuration.

## Errors

For REST requests, handle `401` as a missing, invalid, or revoked API key and `403` as an authenticated key that lacks access to the requested workspace or action. Check the canonical OpenAPI spec at https://docs.outlit.ai/openapi.json for endpoint-specific error shapes.

For MCP requests, invalid authorization should be resolved by reconnecting the workspace MCP URL in the client. If a client cannot complete OAuth, use the CLI or REST API path instead.

## Revocation

Revoke or rotate REST API keys from https://app.outlit.ai/settings/workspace/api-keys.

For MCP access, remove or reconnect the MCP integration in the client, or rotate workspace access from Outlit settings if a URL or credential was shared with the wrong environment.

For help, use https://www.outlit.ai/support or email support@outlit.ai.