Browse docs
API keys: for your own scripts#
Create one in Settings → Developer (Owner or Manager). A key carries a set of scopes, and its effective power is always scopes ∩ your access, so it can never do more than the member who owns it could do by hand. Send it as a bearer token on every request.
http
GET /v1/agency HTTP/1.1
Host: api.skedcast.com
Authorization: Bearer sked_live_AB12…OAuth 2.1: for third-party apps and AI agents#
When your app acts on behalf of someone else's SkedCast workspace, use the Authorization Code flow with PKCE (S256 required). Clients register dynamically (RFC 7591), so there is no manual registration step, and every endpoint is discoverable from /.well-known/oauth-authorization-server.
Tokens are audience-bound (RFC 8707): request resource=https://api.skedcast.com/v1 at the authorize step for a REST API token, or omit it for an MCP-only token.
Which one should I use?#
authenticationapi-keysoauth
FAQ
- Can I use the same API key from a browser?
- No. Never embed an API key in a browser, mobile app or public repo. It grants real access to your workspace. SkedCast shows the secret only once, so a leaked key can't be recovered, only rotated. Use OAuth 2.1 for anything running in an untrusted client.
- How long do OAuth access tokens last?
- 15 minutes. Use the refresh token (valid 30 days, rotated on every use) to get a new one. API keys are long-lived and expire after at most a year.