Authentication

API keys, Sign in with Pekto, and scopes.

Every request sends a Bearer token:

Authorization: Bearer <token>

Pekto accepts three kinds of token. Each one only ever reaches the projects, brand kits and posts of the account it belongs to.

Token	Who uses it	Access
API key (pekto_live_…)	Your code, scripts, automations, MCP clients configured with a header	The scopes you chose when creating it
OAuth access token	AI tools connected with Sign in with Pekto (Claude, ChatGPT, Codex, Cursor…)	The connected-app permissions below
Pekto session token	The Pekto app itself	Everything, including managing API keys

API keys

Create keys in Settings → Developer: give the key a name, choose its scopes and an optional expiry, then copy the secret. Pekto stores only a hash and can’t show it again. From the same page you can see when each key was last used and revoke it at once.

• Up to 20 active keys per account
• 60 requests a minute per key (see Limits)
• Keys can’t create or revoke other keys

Treat a key like a password. Keep it in a secret store or environment variable, never in client-side code or a public repository. If one leaks, revoke it in Settings → Developer.

Sign in with Pekto (OAuth)

AI tools connect with OAuth 2.1, so nobody pastes a key into a chat app. The tool finds the sign-in server on its own:

1. It calls https://api.trypekto.com/mcp and gets 401 with a WWW-Authenticate header pointing at the protected resource metadata.
2. It registers itself and opens Pekto’s sign-in in your browser.
3. You sign in and see which app is asking and what it will be able to do, then choose Allow or Deny.
4. The app receives a token and every MCP call runs as you.

A connected app can read your projects, templates and brand kits; create presentations and carousels (using your credits); edit, duplicate and delete projects; create and delete brand kits; and read your social accounts and schedule or delete unpublished posts. It can’t see your password or manage API keys. Each app is limited to 120 requests a minute.

Disconnect an app any time in Settings → Developer → Connected apps. It’s signed out immediately.

Scopes

Scope	Allows
projects:read	List and read projects, check credits
projects:write	Edit, duplicate and delete projects and their content
templates:read	Browse templates and carousel themes
brand_kits:read	Read brand kits
brand_kits:write	Create and delete brand kits
presentations:create	Generate presentations and carousels (uses credits)
jobs:read	Read generation jobs
social:read	Read connected social accounts and scheduled posts
social:write	Schedule posts and delete unpublished ones

A request without the scope it needs returns 403 insufficient_scope, with the missing scope in error.details.required_scope.