Authentication
Authenticate Platform API and MCP requests with a Bearer token. Two issuance paths: Developer API keys and Connect access tokens.
Developer API key
- Sign in at app.aepto.com.
- Open the avatar menu → API Keys / MCP, or go to app.aepto.com/api-keys.
- Create a key. Copy the secret once - it starts with
aep_live_. - Send it on every request:
Authorization: Bearer aep_live_...Connect access token
After a user completes Sign in with Aepto in your client, call POST https://app.aepto.com/connect/token and use the returned access_token the same way:
Authorization: Bearer <access_token>Full authorize/token flow: Connect overview.
MCP
The MCP endpoint accepts the same Bearer styles. Claude’s official Connectors Directory listing and custom connectors typically use Connect OAuth with the published Claude identity; other hosts can pass an API key via a custom Authorization header. See MCP.
FAQ
What does an Aepto API key look like?
Developer keys start with aep_live_. Create them at app.aepto.com/api-keys (avatar menu → API Keys / MCP) and send Authorization: Bearer aep_live_....
When do I use a Connect token instead of an API key?
Use a Connect access_token after a user completes Sign in with Aepto in your client (Chrome, WordPress, Claude, or a custom OAuth app). Same Bearer header shape.
Where do I set scopes?
Choose scopes when you create the key or when the Connect client requests authorization. Details: Scopes & keys.
Can I revoke access?
Users revoke Connect grants on Connected apps. You can also revoke tokens via POST https://app.aepto.com/connect/revoke and delete API keys at app.aepto.com/api-keys.
Product FAQ hub: FAQ.