Authentication
Browser (web)
Better Auth cookies on the website origin. Google OAuth and email/password both work here. Create and revoke public API keys on Security settings.
Public API
Create a hashed user API key on the website, then send:
Authorization: Bearer ctk_…
or
X-API-Key: ctk_…
The secret is shown once at creation. Sign-in, sign-up, and password reset stay on the website. They are not /v1 routes.
Agents
MCP and /agent/v1 use agent OAuth, not API keys:
- Authorization UI: website
/agent/oauth/authorize - Token and registration: API origin
/agent/oauth/* - Resource:
{API_URL}/agent/mcp