# Authentication

Needle authenticates in two ways. The REST API takes an API key in the `Authorization` header. MCP apps sign in with OAuth in your browser and send their own token from then on. Missing or invalid credentials return `401`.

## REST API

Send this header on every request to `/api/v1`. See the [API Reference](/docs/api-reference/introduction).

`Authorization: Bearer sk-ndl-…`

### Create a key

1. Open [API keys](/api-keys) in the dashboard.
2. Create a key. It looks like `sk-ndl-…`.
3. Copy it once. The full key is only shown then.

### Scope

Each key is bound to one user and one workspace. The dashboard, API, and MCP all work in the workspace the key is bound to.

- **User**: The key acts as the user who created it.
- **Workspace**: Requests run in the workspace the key is bound to.

```bash
curl https://needle.app/api/v1/me \
  -H "Authorization: Bearer sk-ndl-…" \
  -H "Content-Type: application/json"
```

## MCP

Claude, Claude Code, Codex, ChatGPT, Cursor, OpenCode and other MCP apps open a Needle sign-in page in your browser: sign in, click Allow, and the connection is done. Tokens expire after an hour and refresh on their own; the connection shows under [Settings](/settings), where you can disconnect it.

MCP server URL: `https://needle.app/mcp/v1`

[Add to Claude](https://claude.ai/customize/connectors?modal=add-custom-connector&connectorName=Needle&connectorUrl=https%3A%2F%2Fneedle.app%2Fmcp%2Fv1) in one click, or follow the [setup steps](/docs/mcp/introduction#setup) for Claude Code, Codex, ChatGPT, Cursor and OpenCode.

Prefer a key? Any app can send an API key in the same header as the REST API instead of signing in. The setup steps for each app are in [Needle MCP](/docs/mcp/introduction#setup). The tool list at `/mcp/v1/tools` is public.