---
title: 'API authentication'
description: 'Keep sessions, API tokens, OAuth, and signed tools distinct.'
---

# API authentication

Select the authentication method for the surface you are calling.

## Server-side data requests

Issue a project token through Dashboard and keep it in a server environment variable. For example, this read-only request checks that GraphQL accepts the credential without depending on a particular entity schema:

```bash
curl "https://${FLEXKIT_PROJECT_ID}.api.flexkit.io/graphql"   -H "Authorization: Bearer ${FLEXKIT_API_TOKEN}"   -H "Content-Type: application/json"   --data '{"query":"query CheckConnection { __typename }"}'
```

Set `FLEXKIT_PROJECT_ID` and `FLEXKIT_API_TOKEN` in your trusted shell environment first. Do not paste tokens into public repositories, browser bundles, screenshots, or issue reports.

## Studio and MCP

Studio's adapter handles the signed-in session and same-origin proxy. Use the documented framework setup rather than copying browser cookies into integration scripts. [MCP](/docs/integrations/mcp) uses OAuth and the consenting user's project authority.

Custom tools use signed requests with a separate server secret. An API token is not a substitute for the [tool signing secret](/docs/automations/custom-tools/security-and-deployment).

## Diagnose failures

Check the project ID, credential type, revocation, project role, spaces, and service restrictions. Distinguish an authentication failure from a denied operation and a browser [CORS](/docs/api/cors) failure. Inspect GraphQL `errors` even if the HTTP request succeeds.


---

[View full sitemap](/docs/sitemap.md)