Sign-in and API keys

There are two kinds of credential. People connect AI apps by signing in (OAuth). Your own code uses an API key.

	Sign-in (OAuth)	API key
Works on	MCP server	MCP server and REST API
Plans	Advanced, Max and Teams	Max and Teams
Created	By the AI app, when you sign in and allow it	By you, in Settings > Developers
Ended by	Disconnect in Settings > Developers	Revoke in Settings > Developers

Access levels

Each credential has one of three levels. Higher levels include lower ones.

Level	Scopes	Allows
Read only	`read`	Looks things up. Changes nothing.
Read and create	`read write`	Creates or changes things in Chirpy. Publishes nothing. AI work uses credits.
Full access	`read write publish`	Schedule, publish, approve, reply, moderate and delete.

API keys

In Chirpy, open Settings > Developers and create a key with a name and a level.
Copy it straight away. It is shown once; Chirpy keeps only a fingerprint of it.
Send it on every request: Authorization: Bearer chirpy_sk_... (or X-API-Key).

Keep keys private like passwords and revoke any you no longer use. Each person can have up to 10 live keys.

OAuth details for client developers

Chirpy follows the MCP authorization specification (revision 2026-07-28), which builds on OAuth 2.1.

Protected resource metadata	`https:/.chirpy.me/mcp/.well-known/oauth-protected-resource/mcp`
Resource	`https://mcp.chirpy.me/mcp`
Issuer	`https://chirpy.me`
Authorization server metadata	`https://chirpy.me/.well-known/oauth-authorization-server`
Client registration	Client ID Metadata Documents (an https `client_id`), or Dynamic Client Registration at `/oauth/register`
Grant	Authorization code with PKCE (`S256` only), plus refresh tokens
Scopes	`read`, `write`, `publish`
Token audience	Send `resource=https://mcp.chirpy.me/mcp` on the authorization and token requests
Access tokens	Last 1 hour. Accepted by the MCP server only.
Refresh tokens	Last 30 days and rotate on every use. Using one twice ends the connection.
Redirect URIs	Exact match. Loopback addresses (`http://127.0.0.1`, `http://localhost`) match on any port.
Revocation	`https://chirpy.me/oauth/revoke` (RFC 7009)

An MCP request without a valid token gets 401 with a WWW-Authenticate header that points at the protected resource metadata. A token without the needed level gets 403 with error="insufficient_scope" and the scopes to ask for.