> ## Documentation Index
> Fetch the complete documentation index at: https://docs.swoop.it/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate with the Swoop MCP server using OAuth or API keys

The Swoop MCP server supports two authentication methods. All requests must include a valid Bearer token in the `Authorization` header:

```
Authorization: Bearer <your-token>
```

Choose the authentication method that fits your workflow.

<Tabs>
  <Tab title="OAuth 2.0">
    Swoop supports OAuth 2.0 with the authorization code flow. Most of this is handled automatically by the MCP client — you only need to sign in and approve the consent screen.

    **Best for:** Interactive use from desktop AI clients like Claude Desktop.

    ## How it works

    1. Your MCP client discovers the authorization server via `/.well-known/oauth-protected-resource`
    2. A browser window opens for you to sign in with your Swoop account
    3. You review and approve the requested permissions on a consent screen
    4. The client receives an access token and includes it automatically with each request

    ## OAuth discovery

    The Swoop MCP server implements [RFC 9728 (OAuth Protected Resource Metadata)](https://datatracker.ietf.org/doc/html/rfc9728) for OAuth discovery. Clients can retrieve the OAuth configuration metadata at:

    ```
    GET /.well-known/oauth-protected-resource
    ```

    This returns the resource metadata including the authorization server URL and required scopes (`profile`, `email`). Clients use this information to locate the authorization server and initiate the OAuth flow.

    The authorization server metadata is available at:

    ```
    GET /.well-known/oauth-authorization-server
    ```

    This endpoint returns the full authorization server configuration, including the authorization endpoint, token endpoint, and supported grant types.

    ## Dynamic Client Registration

    The authorization server supports [Dynamic Client Registration (DCR)](https://datatracker.ietf.org/doc/html/rfc7591). Clients can discover the registration endpoint URL from the authorization server's metadata (obtained via the OAuth Protected Resource metadata endpoint) and register automatically without manual configuration.

    ## Authentication errors

    When authentication fails, the server returns a `401 Unauthorized` response with a `WWW-Authenticate` header similar to:

    ```
    WWW-Authenticate: Bearer error="invalid_token", error_description="No authorization provided", resource_metadata="https://swoop.it/.well-known/oauth-protected-resource"
    ```

    Clients should use this URI to discover the authorization server and initiate the OAuth flow.
  </Tab>

  <Tab title="API Keys">
    API keys are long-lived tokens that don't require a browser-based login. They are prefixed with `ak_`.

    **Best for:** Automated workflows, CI/CD pipelines, or environments where the OAuth browser flow is not practical.

    <Steps>
      <Step title="Open the Swoop dashboard">
        Go to [swoop.it](https://swoop.it) and sign in.
      </Step>

      <Step title="Create an API key">
        Navigate to your user profile and create a new API key. Copy the key immediately — it won't be shown again.
      </Step>

      <Step title="Use the key in your client">
        Configure your MCP client to send the API key as a Bearer token:

        ```
        Authorization: Bearer ak_your_api_key_here
        ```
      </Step>
    </Steps>

    <Warning>
      Treat API keys as secrets. Do not commit them to version control or share them publicly. If a key is compromised, revoke it immediately from the Swoop dashboard.
    </Warning>
  </Tab>
</Tabs>