Agent Access & Authentication

auto-social.io provides multiple ways for external agents, developer tools, and automation pipelines to interact securely with your workspace.

Authentication Methods

There are two primary ways to authenticate with auto-social.io agent interfaces:

1. API Keys (ask_...): Best for CLI tools, server scripts, and CI/CD automation.
2. OAuth 2.0 (MCP OAuth / PKCE): Designed for desktop agent clients like Cursor, Claude Desktop, and VS Code.

API Keys

Generating an API Key

1. Log into auto-social.io and navigate to Account Settings.
2. Go to the Agent access card.
3. Click the New API key button.
4. Enter a Key name to identify this key (for example: Cursor Assistant, CLI deploy worker).
5. Click Create key.
6. In the modal, click Copy key to copy the secret (ask_...) immediately. For security, keys cannot be displayed again after closing.

Using API Keys

You can pass your API key as a Bearer token in the Authorization header:

curl -X POST https://auto-social.io/api/v1/tools/list_campaigns \  -H "Authorization: Bearer ask_your_api_key_here" \  -H "Content-Type: application/json" \  -d '{"status":"active"}'

Or configure environment variables for CLI usage:

export AUTO_SOCIAL_API_KEY="ask_your_api_key_here"export AUTO_SOCIAL_URL="https://auto-social.io"

MCP OAuth (PKCE)

For AI agents that support MCP (Model Context Protocol) authentication:

• Authorize Endpoint: https://auto-social.io/api/mcp/oauth/authorize
• Token Endpoint: https://auto-social.io/api/mcp/oauth/token

The OAuth flow uses standard Proof Key for Code Exchange (PKCE) to securely issue scoped access tokens without storing long-lived master passwords on your client machines.

Revoking Credentials

If an API key or agent credential is compromised:

1. Visit Account Settings, under Agent access.
2. Locate the key in the list.
3. Click the trash icon button (Revoke key). All subsequent requests using that credential will immediately fail with a 401 Unauthorized status.