Authentication

Sign in with OAuth, or create an agent key. Both land on the same permissions.

There are two ways to authenticate, and they reach exactly the same surface. Which one you want depends on whether a human is present to click Approve.

Sign in (OAuth 2.1)

For Claude Code, Claude Desktop, claude.ai and any MCP client that can open a browser. No key is copied or stored anywhere.

Agent key

For CI, scripts, backends and clients with no sign-in flow. A bearer token you paste into a config file.

Both are clamped to the same read plus safe-write ceiling. Authenticating differently never widens what you can call, so choose on convenience rather than access.

Sign in with OAuth

The MCP endpoint is fronted by its own OAuth 2.1 authorization server, so a client only needs a URL. It registers itself, no client id or secret required.

claude mcp add --transport http reputably https://app.reputably.net/api/mcp
# then run /mcp and choose "Authenticate"

Two things worth knowing:

• The issuer is per hostname. app.reputably.net and every verified white-label domain are each their own authorization server. Connect on the domain you actually use, and you sign in and consent on that domain’s branding. A token issued for one host is refused on another.
• Discovery lives at the origin root, not under /api: https://app.reputably.net/.well-known/oauth-authorization-server.

Connected apps are listed under Settings → API & MCP → Connected apps, where each one can be disconnected individually.

Create an agent key

Agent keys are managed by the agency owner in Settings → API & MCP. One active key per agency.

curl https://app.reputably.net/api/functions/getActiveSyncs \
  -H "Authorization: Bearer rpk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

The key is shown once, when you create or rotate it. Only a hash is stored, so it can never be displayed again. Lose it and you rotate.

Three behaviours that surprise people:

• Rotating revokes every live key, not just the one shown on screen, and mints a fresh one. After it returns, no previous key works.
• Revoking a key does not disconnect OAuth apps. They are a separate credential with a separate lifecycle. Disconnect those under Connected apps.
• The key acts as the owner. Requests inherit that account’s workspace access, then get clamped to the read plus safe-write surface.

Bearer only

Every request on this surface authenticates with an Authorization: Bearer header. A browser cookie session can never drive it, by design: a cross-site request automatically attaches cookies, and it can never attach a header. A 401 with a WWW-Authenticate challenge means the header is missing, or the credential in it was revoked or is not recognised.

White-label domains

If you reach Reputably on your agency’s own verified domain, use that domain everywhere: the MCP URL, the API base URL and OAuth discovery. The connection snippets inside Settings → API & MCP are already filled in with the right host, which is the safest place to copy them from.