Authentication
Every call carries an API key in the Authorization header.
Send the key as a bearer token:
Authorization: Bearer ts_...A key acts as the account that created it: it sees and spends what that account sees and spends. Create and delete keys in Settings → API keys; deleting a key stops it at once.
AI assistants
Assistants connected to the remote MCP server sign in with OAuth instead: you sign in to typestrict once and allow the assistant, and it gets a token that acts as your account. To disconnect one, remove the connector in the assistant.
Keep it secret
- Read it from an environment variable or a secret manager, never from code or a repository.
- Call the API from your servers. A key in a browser or a mobile app is a key anyone can copy.
- One key per place that uses it, so revoking one does not stop the others.
Keys start with ts_, so secret scanners can recognize a leaked one.
Errors
A missing, unknown, disabled or expired key answers 401:
{ "error": "unauthorized", "message": "unauthorized" }Every error has the same shape: a stable error code to branch on and a message for people.