Start for free
Browse docs▾

Agent Access & Authentication

Learn how to authenticate AI agents, manage API keys, and configure MCP OAuth.

auto-social.io provides multiple ways for external agents, developer tools, and automation pipelines to interact securely with your workspace.

Authentication Methods

There are two primary ways to authenticate with auto-social.io agent interfaces:

  1. API Keys (ask_...): Best for CLI tools, server scripts, and CI/CD automation.
  2. OAuth 2.0 (MCP OAuth / PKCE): Designed for desktop agent clients like Cursor, Claude Desktop, and VS Code.

API Keys

Generating an API Key

  1. Log into auto-social.io and navigate to Account Settings.
  2. Go to the Agent access card.
  3. Click the New API key button.
  4. Enter a Key name to identify this key (for example: Cursor Assistant, CLI deploy worker).
  5. Click Create key.
  6. In the modal, click Copy key to copy the secret (ask_...) immediately. For security, keys cannot be displayed again after closing.

Using API Keys

You can pass your API key as a Bearer token in the Authorization header:

bash
curl -X POST https://auto-social.io/api/v1/tools/list_campaigns \  -H "Authorization: Bearer ask_your_api_key_here" \  -H "Content-Type: application/json" \  -d '{"status":"active"}'

Or configure environment variables for CLI usage:

bash
export AUTO_SOCIAL_API_KEY="ask_your_api_key_here"export AUTO_SOCIAL_URL="https://auto-social.io"

MCP OAuth (PKCE)

For AI agents that support MCP (Model Context Protocol) authentication:

  • Authorize Endpoint: https://auto-social.io/api/mcp/oauth/authorize
  • Token Endpoint: https://auto-social.io/api/mcp/oauth/token
  • Discovery: GET /.well-known/oauth-protected-resource and GET /.well-known/oauth-authorization-server

The OAuth flow uses standard Proof Key for Code Exchange (PKCE) to securely issue scoped access tokens without storing long-lived master passwords on your client machines.

Pre-registered client id: auto-social-mcp (scope mcp:tools). Third-party clients can use Client ID Metadata Documents. Full setup: MCP server.

Where to go next

  • Agent guide: surfaces, confirmation codes, Skills
  • MCP server: Cursor and Claude configuration
  • CLI: @auto-social-io/cli
  • REST API: POST /api/v1/tools/:toolName
  • Brands: brand tools on every agent surface
  • llms.txt: machine-readable index

Revoking Credentials

If an API key or agent credential is compromised:

  1. Visit Account Settings, under Agent access.
  2. Locate the key in the list.
  3. Click the trash icon button (Revoke key). All subsequent requests using that credential will immediately fail with a 401 Unauthorized status.