API basics

Authentication

Use a personal API key or an access token issued by an approved OAuth client.
View as Markdown

Every API and MCP credential represents one Alpha user. The credential can reach only the organizations and vaults that user can access.

Personal API keys

Personal keys are the recommended authentication method for backend services, scripts, and the official SDKs.

  1. Open Profile > API keys.
  2. Create a key with a clear name and the minimum required role.
  3. Copy it immediately. Alpha stores only a hash and cannot show it again.
  4. Send it as a bearer token.
1Authorization: Bearer azk_...

Do not expose a key in browser code or commit it to a repository. Rotate a key by creating a replacement, updating the service, and revoking the old key.

OAuth 2.1

Alpha also accepts access tokens issued by its OAuth authorization server. OAuth is currently intended for approved MCP clients, including Claude and Slack’s external MCP connection flow.

Discovery endpoints:

  • Authorization server: https://mcp.openantares.com/.well-known/oauth-authorization-server
  • API protected resource: https://mcp.openantares.com/.well-known/oauth-protected-resource/v1
  • MCP protected resource: https://mcp.openantares.com/.well-known/oauth-protected-resource/mcp

The flow supports authorization code exchange, PKCE with S256, and public or confidential clients. Access tokens last 30 days. Alpha currently accepts only allowlisted redirect URI hosts, so contact Antares before building a new third-party OAuth client.

Revocation and access changes

OAuth tokens and API keys use the same authorization path. Removing a user from a vault or changing their role changes what an existing credential can do. Revoking the credential stops it entirely.