Skip to navigation
API basics

Authentication

Use a personal API key or an access token issued by an approved OAuth client.
View as Markdown

Every API and MCP credential represents one Alpha user. The credential can reach only the organizations and vaults that user can access.

Personal API keys

Personal keys are the recommended authentication method for backend services, scripts, and the official SDKs.

  1. Open Profile > API keys.
  2. Create a key with a clear name. The key inherits your live Alpha access and has no separate role setting.
  3. Copy it immediately. Alpha stores only a hash and cannot show it again.
  4. Send it as a bearer token.
Authorization: Bearer antares_...

Do not expose a key in browser code or commit it to a repository. Rotate a key by creating a replacement, updating the service, and revoking the old key.

OAuth 2.1

Alpha also accepts access tokens issued by its OAuth authorization server. OAuth is currently intended for approved MCP clients, including Claude and Slack’s external MCP connection flow.

Discovery endpoints:

  • Authorization server: https://mcp.openantares.com/.well-known/oauth-authorization-server
  • API protected resource: https://mcp.openantares.com/.well-known/oauth-protected-resource/v1
  • MCP protected resource: https://mcp.openantares.com/.well-known/oauth-protected-resource/mcp

The flow supports authorization code exchange, PKCE with S256, and public or confidential clients. Access tokens last 30 days. Alpha currently accepts only allowlisted redirect URI hosts, so contact Antares before building a new third-party OAuth client.

Inherited access and revocation

OAuth tokens and API keys use the same authorization path. A credential can list only the vaults its owner can access. Every vault-bound request must select one of them explicitly.

  • A vault member can use read tools in that vault.
  • A vault manager or organization admin can also use write and action tools in that vault.
  • The same credential can therefore be read-only in one vault and able to write in another.
  • Removing the user from a vault or changing their role affects existing credentials immediately.
  • Revoking the credential stops it entirely.