Authentication

Spectre supports two authentication methods: OAuth for Claude (web and mobile) and API keys for all other clients. Both give your agent access to the same 9 tools with identical behavior.

OAuth (Claude web & mobile)

OAuth is the recommended path for Claude users. It requires no API key management — you paste the MCP URL into Claude, approve the connection once, and Claude handles token lifecycle automatically.

The flow:

1. Claude requests the MCP server URL without credentials. Spectre responds with a WWW-Authenticate header pointing at /.well-known/oauth-protected-resource.
2. Claude follows the OAuth authorization flow. Spectre uses Stytch Connected Apps to handle the consent screen and token issuance.
3. After approval, Stytch issues a token. Claude sends this token as a Bearer token on subsequent requests. From Spectre's perspective, OAuth tokens and API keys are treated identically — same tool list, same behavior.

The OAuth flow is fully live and is the authentication path used by Claude web and mobile clients connecting to Spectre.

API keys

For desktop and CLI clients that do not support OAuth-connected MCP servers, use an API key. API keys use the format sk_live_ followed by 32 base64url characters.

Generate a key

Visit your dashboard and click Generate key. You will create one active key per account. The full key is shown once — save it immediately. Spectre stores only a SHA-256 hash and cannot recover the raw key after you leave the page.

Send the key

The MCP server accepts API keys in two places. The header method is recommended for all clients that support it.

Header (primary)

Set the Authorization header on every request:

Authorization: Bearer sk_live_your_key_here

For MCP clients that accept a config JSON block, use this shape:

{
  "mcpServers": {
    "spectre": {
      "url": "https://mcp.spectremcp.site/",
      "headers": {
        "Authorization": "Bearer sk_live_your_key_here"
      }
    }
  }
}

Query parameter (bridge)

For clients that do not support custom headers on every request, append the key as a query parameter:

https://mcp.spectremcp.site?key=sk_live_your_key_here

This is a bridge method. Header-based auth is preferred wherever supported.

Both paths are equivalent

Whether your agent authenticates with OAuth or an API key, it gets the same 9 tools, the same parameter schemas, and the same response shapes. There is no scoping difference between the two auth methods — the MCP server distinguishes them purely by token prefix (sk_live_ → API key lookup; anything else → OAuth introspection). Pick whichever path your client supports.