Authentication
Use an API key for the REST API and coding tools, or sign in with your Typetone account when you connect Claude, ChatGPT and other AI apps.
Who has access
The API and MCP server are available to workspaces on the Enterprise plan. Access is checked on every request: when a workspace leaves the plan, or a user leaves the workspace, their access stops.
API keys
An API key gives access to one workspace. Create keys in the Typetone app under Settings → MCP & API. Each key has a name and an expiry date (up to two years), and you can revoke it there at any time.
Send the key in the X-API-Key header:
X-API-Key: your-api-keyThe MCP server also accepts it as a bearer token, which is what most coding tools send:
Authorization: Bearer your-api-keyKeys act for the workspace, not for a person
Review decisions and comments made with an API key are recorded for the workspace. They can’t clear an assignment another reviewer owns. When reviewers label violations, let them connect with their own account (OAuth) instead, so every decision carries their name.
Sign in with your Typetone account (OAuth)
AI apps such as Claude and ChatGPT connect to the MCP server with OAuth. You add the server URL, the app sends you to the Typetone login, and from then on the assistant acts as you: with your access and under your name.
For client developers and connector directories:
| Flow | OAuth 2.1 authorization code with PKCE (S256), public clients |
| Client registration | Dynamic client registration |
| Protected resource metadata | https://api.app.typetone.ai/.well-known/oauth-protected-resource/mcp |
| Authorization server metadata | https://api.app.typetone.ai/.well-known/oauth-authorization-server |
| Scopes | mcp:connect, offline_access |
| Tokens | Access tokens last one hour. Refresh tokens last 30 days and rotate on every use. |
| Issuer in responses | Every authorization response includes iss (RFC 9207). |
An unauthenticated request to the MCP server returns 401 with a WWW-Authenticate header that points to the protected resource metadata, so compliant clients discover the login on their own.
Building an integration and your redirect URI is rejected? Redirect URIs are allowlisted. Contact us with the exact URI.
Something unclear or missing? Tell us and we'll improve this page.