# Authentication

Source: https://finchreach.com/docs/authentication

Finchreach accepts two credentials: OAuth 2.1 access tokens, which MCP clients like ChatGPT and Claude obtain on their own after you approve a consent page, and API keys you create in the dashboard. Both go in `Authorization: Bearer <token>` and are limited by scopes.

## OAuth 2.1 for ChatGPT, Claude and other MCP clients

The MCP server at `https://mcp.finchreach.com/mcp` is an OAuth 2.1 protected resource, following the MCP authorization spec. A client that gets a 401 discovers everything it needs and signs you in:

1. Discovery: the 401 points to `https://mcp.finchreach.com/.well-known/oauth-protected-resource/mcp` (RFC 9728), which names the authorization server; its metadata is at `https://mcp.finchreach.com/.well-known/oauth-authorization-server` (RFC 8414).
2. Registration: the client registers itself at `https://mcp.finchreach.com/register` (RFC 7591 dynamic client registration, public clients only).
3. Authorization: the client sends you to `https://mcp.finchreach.com/authorize` with PKCE (S256, required) and `resource=https://mcp.finchreach.com/mcp` (RFC 8707). You sign in to Finchreach and approve the scopes on the consent page.
4. Tokens: the client exchanges the code at `https://mcp.finchreach.com/token`. Access tokens last 1 hour; refresh tokens last 30 days and rotate on every use.
5. Revocation: `https://mcp.finchreach.com/revoke` (RFC 7009).

OAuth tokens can carry every scope except `api_keys:manage`: `accounts:read`, `accounts:write`, `linkedin:read`, `linkedin:write`, `actions:read`, `actions:approve`.

## API keys

Create a key under [API keys](https://finchreach.com/api-keys), pick its scopes and copy it: it is shown once and stored only as a hash. Send it to the MCP server or the REST API:

Header:
```text
Authorization: Bearer <your key>
```

Revoke a key from the same page; it stops working at once. Each key has its own [rate limits](https://finchreach.com/docs/rate-limits#per-key).

## Scopes

| Scope | Allows |
| --- | --- |
| `accounts:read` | List connected LinkedIn accounts |
| `accounts:write` | Connect, pause and remove accounts |
| `linkedin:read` | Every LinkedIn read tool |
| `linkedin:write` | Every LinkedIn write tool (queued for approval when approval is on) |
| `actions:read` | Read the status of pending actions |
| `actions:approve` | Approve or reject pending actions (not with the key that proposed them) |
| `api_keys:manage` | Create and revoke API keys (API keys only) |

An MCP client only sees the tools its scopes allow. A call without the scope fails with `insufficient_scope` ([Errors](https://finchreach.com/docs/errors)).

## Related

- [Quickstart](https://finchreach.com/docs/quickstart)
- [Errors](https://finchreach.com/docs/errors)