> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trypekto.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, Sign in with Pekto, and scopes.

Every request sends a Bearer token:

```http theme={null}
Authorization: Bearer <token>
```

Pekto accepts three kinds of token. Each one only ever reaches the projects, brand kits and posts of the account it belongs to.

| Token | Who uses it | Access |
| - | - | - |
| API key (`pekto_live_…`) | Your code, scripts, automations, MCP clients configured with a header | The scopes you chose when creating it |
| OAuth access token | AI tools connected with **Sign in with Pekto** (Claude, ChatGPT, Codex, Cursor…) | The connected-app permissions below |
| Pekto session token | The Pekto app itself | Everything, including managing API keys |

## API keys

Create keys in **Settings → Developer**: give the key a name, choose its scopes and an optional expiry, then copy the secret. Pekto stores only a hash and can't show it again. From the same page you can see when each key was last used and revoke it at once.

* Up to 20 active keys per account
* 60 requests a minute per key (see [Limits](/limits))
* Keys can't create or revoke other keys

<Warning>
  Treat a key like a password. Keep it in a secret store or environment variable, never in client-side code or a public repository. If one leaks, revoke it in Settings → Developer.
</Warning>

## Sign in with Pekto (OAuth)

AI tools connect with OAuth 2.1, so nobody pastes a key into a chat app. The tool finds the sign-in server on its own:

1. It calls `https://api.trypekto.com/mcp` and gets `401` with a `WWW-Authenticate` header pointing at the [protected resource metadata](https://api.trypekto.com/.well-known/oauth-protected-resource/mcp).
2. It registers itself and opens Pekto's sign-in in your browser.
3. You sign in and see which app is asking and what it will be able to do, then choose **Allow** or **Deny**.
4. The app receives a token and every MCP call runs as you.

A connected app can read your projects, templates and brand kits; create presentations and carousels (using your credits); edit, duplicate and delete projects; create and delete brand kits; and read your social accounts and schedule or delete unpublished posts. It can't see your password or manage API keys. Each app is limited to 120 requests a minute.

Disconnect an app any time in **Settings → Developer → Connected apps**. It's signed out immediately.

## Scopes

| Scope | Allows |
| - | - |
| `projects:read` | List and read projects, check credits |
| `projects:write` | Edit, duplicate and delete projects and their content |
| `templates:read` | Browse templates and carousel themes |
| `brand_kits:read` | Read brand kits |
| `brand_kits:write` | Create and delete brand kits |
| `presentations:create` | Generate presentations and carousels (uses credits) |
| `jobs:read` | Read generation jobs |
| `social:read` | Read connected social accounts and scheduled posts |
| `social:write` | Schedule posts and delete unpublished ones |

A request without the scope it needs returns `403 insufficient_scope`, with the missing scope in `error.details.required_scope`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.