Authentication

There are two ways to authenticate, and which one you want depends on what you are connecting.

	For	What you do
OAuth	AI tools with a "Connect" button — Claude, ChatGPT, Cursor, VS Code, Zapier	Paste one URL, approve a consent screen
API key	The REST API, scripts, and editors that want a static header	Create a key, send it as a bearer token

OAuth (no key needed)

If you are connecting an AI tool, use this. Point it at:

https://schedulenchill.com/mcp-oauth

Your tool discovers the rest on its own, sends you to a Schedule & Chill consent screen naming the tool and listing what it is asking for, and receives its own token when you approve. Nothing is copied or stored by you.

Each tool holds a separate token, so revoking one does not affect the others, and your password is never shared. Full setup per tool: Connect Your AI Tool.

This path is not available for the REST API — it authenticates with API keys only.

API keys

Send your key in the Authorization header on every request:

Authorization: Bearer YOUR_API_KEY

A request without a valid key returns 401 Unauthorized.

Creating a key

1. Sign in and open Settings → API Keys.
2. Click Create Key, give it a name (e.g. Production Server, Claude Desktop).
3. Copy the token immediately — for security it is shown only once and cannot be retrieved later. If you lose it, revoke the key and create a new one.

You can also manage keys over the REST API itself — see API Keys.

Using the key

Send it on every request to the REST API and the MCP server:

curl https://schedulenchill.com/api/posts \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Accept: application/json"

Token lifetime

Keys do not expire automatically. They remain valid until you revoke them under Settings → API Keys (or via DELETE /api/api-keys/{id}).

Security

• Treat keys like passwords. Store them in a secrets manager or environment variables — never in client-side code or version control.
• Use a separate key per integration so you can revoke one without affecting others.
• Rotate keys periodically by creating a new one and revoking the old.

Scope

A key acts on behalf of the user who created it and can access that user's posts, media, and connected accounts. There are no per-key permission scopes yet.

An OAuth token is scoped to mcp:use, which grants the MCP server and nothing else. A token issued for any other purpose is rejected at the MCP endpoint even though it authenticates.