Authentication

API keys for REST, OAuth for MCP, and what revocation actually does.

Two credentials, two lifetimes

REST uses an API key you mint at Settings → API & MCP. Send it as a bearer token. It does not expire unless you say so.

REST

curl -s "https://api.askdeck.ai/v1/decks?limit=1" -H "Authorization: Bearer $ASKDECK_API_KEY"

MCP uses OAuth. You never paste a credential — you paste https://mcp-api.askdeck.ai/mcp and the client walks you through a browser sign-in. Access tokens are short-lived and re-checked on every call.

What revocation actually costs you, in seconds

Revoke a key in Settings → API & MCP and it stops immediately for anything that spends. A spend is never served from a cached verdict — it is always re-checked with Clerk.

A plain read may be served from a cached verdict for up to 60 seconds after revocation. That is the entire window, and it is a cost decision about introspection volume, not a security compromise: nothing chargeable happens inside it.

An MCP grant behaves the same way for the same reason: the MCP server keeps successful verifications for up to 90 seconds, but every call that spends is re-checked downstream with no cache at all, so a revoked grant cannot buy anything.

In one line: revocation stops spending instantly on both surfaces, and stops reading within about a minute and a half. There is no multi-hour window, and you never need to ask us to disable an account to make a revocation stick.

If you see 403 not_enrolled

The public API is switched on for everyone; access rolls out in waves, so a brand-new account can briefly see 403 forbidden with reason: "not_enrolled". Nothing about your key is wrong — it is not a scope problem, and neither re-minting the key nor re-authenticating changes the answer. Your existing keys and grants start working the moment your account is in, with nothing to redo. If it persists beyond a day, contact support with the requestId from the response.

Keep the issuer stable

MCP clients store your grant keyed by the server's issuer URL. If the issuer changes, every client you have connected loses its credential at the same moment and asks you to sign in again. We treat the issuer as frozen and announce any change on the changelog feed.