Skip to content
ToolCargo

Docs · Updated 2026-09-11

Authentication & keys

Two ways in — API keys and OAuth — both scoped per connector and revocable from your dashboard.

API keys

  • Created in the dashboard; shown once. We store only a SHA-256 hash, so a lost key cannot be recovered — revoke it and create another.
  • Format: tp_live_ followed by 43 random characters. Send as Authorization: Bearer …. Keys in URLs or query strings are not accepted.
  • Each key carries scopes, one per connector (for example connector:site-audit). A key without a connector's scope gets HTTP 403 on that connector.
  • Up to 10 active keys per account. Keys do not expire; revocation takes effect on the next request.

OAuth

For clients that cannot send custom headers (Claude, ChatGPT). ToolCargo runs an OAuth 2.1 authorization server:

  • Discovery: each MCP endpoint answers unauthenticated requests with HTTP 401 and a WWW-Authenticate header pointing to its Protected Resource Metadata (RFC 9728), e.g. https://toolcargo.com/.well-known/oauth-protected-resource/mcp/site-audit. Server metadata is at https://toolcargo.com/.well-known/oauth-authorization-server.
  • Clients identify with a Client ID Metadata Document (an https URL) or register dynamically (RFC 7591). Public clients only.
  • Authorization code flow with PKCE (S256 required). The resource parameter binds tokens to one connector, e.g. https://toolcargo.com/mcp/site-audit; a token for one connector is rejected by another.
  • Access tokens last one hour. Refresh tokens last 30 days and rotate on every use; reusing an old refresh token or authorization code revokes the whole grant.
  • Every approval appears under “Connected apps” in your dashboard, where you can revoke it.

Rate limits and quotas

  • Per credential: calls per minute depend on the plan (see pricing).
  • Per account and connector: a monthly call quota, reserved atomically before each call and refunded when the call fails validation or errors on our side.
  • Tool results always end with your current usage, so the assistant can tell you when you are close to the limit.

Account isolation

Every credential resolves to exactly one account. Tools run with that account's entitlement and record usage against it; dashboard actions (revoking keys, cancelling, deleting) only affect rows owned by the signed-in account. Site Audit results are returned to the caller and not stored.