# Authentication: API keys and OAuth 2.1
URL: https://skedcast.com/developers/guides/social-media-api-authentication

SkedCast has two ways to prove who is calling and what they may do: an API key (bearer token) for your own server-side scripts, and OAuth 2.1 with mandatory PKCE for a third-party app or AI agent acting on someone else's workspace. API and MCP access depend on your plan (see pricing).

## API keys: for your own scripts
Create one in Settings → Developer (Owner or Manager). A key carries a set of scopes, and its effective power is always scopes ∩ your access, so it can never do more than the member who owns it could do by hand. Send it as a bearer token on every request.

## Example
```http
GET /v1/agency HTTP/1.1
Host: api.skedcast.com
Authorization: Bearer sked_live_AB12…
```

## OAuth 2.1: for third-party apps and AI agents
When your app acts on behalf of someone else's SkedCast workspace, use the Authorization Code flow with PKCE (S256 required). Clients register dynamically (RFC 7591), so there is no manual registration step, and every endpoint is discoverable from `/.well-known/oauth-authorization-server`.
Tokens are audience-bound (RFC 8707): request `resource=https://api.skedcast.com/v1` at the authorize step for a REST API token, or omit it for an MCP-only token.

## Which one should I use?
Use case | Use
A cron job, backend service or internal tool you own | API key
An app other SkedCast users install and authorize | OAuth 2.1
An AI agent (Claude, ChatGPT, a custom agent) acting for a user | OAuth 2.1. The MCP server accepts OAuth only; your own single-workspace agent can call the REST API with an API key
A CI pipeline that publishes on a schedule | API key, scoped to just `posts.compose`

## FAQ
**Q: Can I use the same API key from a browser?**
A: No. Never embed an API key in a browser, mobile app or public repo. It grants real access to your workspace. SkedCast shows the secret only once, so a leaked key can't be recovered, only rotated. Use OAuth 2.1 for anything running in an untrusted client.

**Q: How long do OAuth access tokens last?**
A: 15 minutes. Use the refresh token (valid 30 days, rotated on every use) to get a new one. API keys are long-lived and expire after at most a year.