Authentication

API keys for REST, OAuth for MCP, and what revocation actually does.

Two credentials, two lifetimes

REST uses an API key you mint at Settings → API & MCP. Send it as a bearer token. It does not expire unless you say so.

REST

curl -s "https://api.askdeck.ai/v1/decks?limit=1" -H "Authorization: Bearer $ASKDECK_API_KEY"

MCP uses OAuth. You never paste a credential — you paste https://mcp-api.askdeck.ai/mcp and the client walks you through a browser sign-in. Access tokens are short-lived and re-checked on every call.

What revocation actually costs you, in seconds

Revoke a key in Settings → API & MCP and it stops immediately for anything that spends. A spend is never served from a cached verdict — it is always re-checked with Clerk.

A plain read may be served from a cached verdict for up to 60 seconds after revocation. That is the entire window, and it is a cost decision about introspection volume, not a security compromise: nothing chargeable happens inside it.

An MCP grant behaves the same way for the same reason: the MCP server keeps successful verifications for up to 90 seconds, but every call that spends is re-checked downstream with no cache at all, so a revoked grant cannot buy anything.

In one line: revocation stops spending instantly on both surfaces, and stops reading within about a minute and a half. There is no multi-hour window, and you never need to ask us to disable an account to make a revocation stick.

Access is an allow-list right now

While the surface is in preview, your account has to be enabled explicitly. A valid key on a non-enabled account returns 403 forbidden. That is not a scope problem and re-minting will not fix it.

Keep the issuer stable

MCP clients store your grant keyed by the server's issuer URL. If the issuer changes, every client you have connected loses its credential at the same moment and asks you to sign in again. We treat the issuer as frozen and announce any change on the changelog feed.