Authentication
v1Scoped bearer keys, separate test and live environments, and credentials that stay on your server.
OAuth for agents and the CLI
MCP clients and the CLI use browser sign-in with authorization-code + PKCE. Inspect the unverified app name, callback origin, workspace, mode and requested permissions. Read scopes start selected; write permissions require your explicit choice. Test is the default unless the client explicitly requested Live.
A grant stays bound to its workspace, mode, resource and selected scopes. Access tokens expire, refresh tokens rotate, and Developers → Agents lets you revoke the whole grant. OAuth never exposes platform credentials or creates API keys.
Bearer keys
Send your key in the Authorization header on every request. Keys belong to a single workspace and environment. Keys are displayed once, stored as hashes, and can be revoked from Developers.
Authorization: Bearer cr_test_your_key| Prefix | Environment | Behavior |
|---|---|---|
cr_test_ | Test | Simulated accounts and publishing. No live social post. |
cr_live_ | Live | Real connected accounts. Platform permissions and approvals apply. |
Choose the smallest useful scope
| Scope | Allows |
|---|---|
accounts:read | List connected accounts, capabilities, Pinterest boards/sections and connection-session status |
accounts:write | Create test accounts, assign profiles, manage connection sessions, record explicit YouTube analytics privacy acceptance and disconnect accounts |
posts:read | List and retrieve posts |
posts:write | Create and cancel posts |
comments:read | List supported post comments |
comments:write | Reply to supported comments |
webhooks:read | Inspect endpoints and deliveries |
webhooks:write | Create and disable webhook endpoints |
logs:read | Inspect API request logs |
profiles:read | List and inspect customer profiles |
profiles:write | Create, edit and delete profiles |
media:read | List private assets and inspect previews |
media:write | Upload, complete and delete media |
analytics:read | Read cached performance metrics |
analytics:write | Refresh post metrics |
usage:read | Read OAuth grant usage; API keys have implicit access |
Every active API key can read its own plan usage with GET /usage; no additional scope is needed. OAuth grants require usage:read for the same operation. See Plans and limits.
Keep secrets on your server
Never put keys in browser code, mobile bundles, screenshots, or public repositories. Use separate keys for separate services. Create a replacement before revoking a key used by an active integration.
API keys cannot create other API keys. Key administration requires a signed-in workspace session.