Documentation

Authentication

Two ways in: API keys for the REST API, sign-in for MCP.

Needle authenticates in two ways. The REST API takes an API key in the Authorization header. MCP apps sign in with OAuth in your browser and send their own token from then on. Missing or invalid credentials return 401.

REST APIAPI key MCPOAuth sign-in

Request header

Copy

Authorization: Bearer sk-ndl-…

Send this header on every request to /api/v1. See the API Reference.

Create a key

1
Open API keys in the dashboard.
2
Create a key. It looks like sk-ndl-….
3
Copy it once. The full key is only shown then.

Get API key

Scope

Each key is bound to one user and one workspace. The dashboard, API, and MCP all work in the workspace the key is bound to.

User

The key acts as the user who created it.

Workspace

Requests run in the workspace the key is bound to.

Example

Copy

curl https://needle.app/api/v1/me \
  -H "Authorization: Bearer sk-ndl-…" \
  -H "Content-Type: application/json"

Create a key

Scope

Example

Search docs